Dashboard / CVE-2026-69142

CVE-2026-69142

HIGH
MEDIUM Priority: 0.03 BB Relevance: 68/100
Published: 2026-11-05 Modified: 2026-11-10 First seen: 2026-11-05 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: High
I: High
A: High

Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the jjwg_Maps map marker endpoint uses the authenticated caller's distance value in the map_markers action without strict numeric validation or parameterization. An authenticated attacker can alter the SQL query, extract database data, modify query results, and consume resources. This issue is fixed in versions 7.15.2 and 8.10.2.

Weakness Classification (1)

Affected Software (5)

VendorProductVersion
SuiteCRM SuiteCRM < 7.15.2
SuiteCRM SuiteCRM >= 8.0.0, < 8.10.2
SuiteCRM SuiteCRM < 7.15.2
SuiteCRM SuiteCRM >= 8.0.0, < 8.10.2
suitecrm suitecrm < 7.15.2

References & Advisories (5)

Bug Bounty Relevance

68 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

8.8 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

0.36%
Raw Score 0.003600
Percentile 30.2%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00360
2026-11-12
0.00360
2026-11-10
0.00352
2026-11-09
0.00352
2026-11-08
0.00352
2026-11-07
0.00352
2026-11-06
0.00352

Intelligence Sources

mitre ref →
nvd ref →

External Links