Dashboard / CVE-2026-61651

CVE-2026-61651

HIGH
MEDIUM Priority: 0.03 BB Relevance: 67/100
Published: 2026-11-05 Modified: 2026-11-10 First seen: 2026-11-05 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: High
I: High
A: Low

Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the get_end_date action in Projects Controller concatenates an authenticated caller's task_id value into a SQL query without parameterization. A low-privileged user can use blind SQL injection to enumerate the database schema and extract credentials, customer records, and other database contents. This issue is fixed in versions 7.15.2 and 8.10.2.

Weakness Classification (1)

Affected Software (5)

VendorProductVersion
SuiteCRM SuiteCRM < 7.15.2
SuiteCRM SuiteCRM >= 8.0.0, < 8.10.2
SuiteCRM SuiteCRM < 7.15.2
SuiteCRM SuiteCRM >= 8.0.0, < 8.10.2
suitecrm suitecrm < 7.15.2

References & Advisories (5)

Bug Bounty Relevance

67 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

8.3 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

EPSS — Exploitation Probability

0.32%
Raw Score 0.003160
Percentile 24.9%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00316
2026-11-12
0.00316
2026-11-10
0.00309
2026-11-09
0.00309
2026-11-08
0.00309
2026-11-07
0.00309
2026-11-06
0.00309

Intelligence Sources

mitre ref →
nvd ref →

External Links