ZeroDay Findings
Sign inSign up

Findings

CVE-2026-29099

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.

Published Mar 19, 2026 · updated Jun 17, 2026 · suitecrm suitecrm

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the function in fails to properly neutralize the user controlled parameter. It is assumed that the function calling will appropriately quote and sanitize the user input. However, two locations have been identified that can be reached through the action on the module where this is not the case. As such, it is possible for an authenticated user to perform SQL injection through the function. This affects the latest major versions 7.15 and 8.9. As there do not appear to be restrictions on which tables can be called, it would be possible for an attacker to retrieve arbitrary information from the database, including user information and password hashes. Versions 7.15.1 and 8.9.3 patch the issue.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 19, 2026 · NIST NVD

    Detected

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the function in fails to properly neutralize the user controlled parameter. It is assumed that the function calling will appropriately quote and sanitize the user input. However, two locations have been identified that can be reached through the action on th

  2. Jun 17, 2026 · NIST NVD

    Updated

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the function in fails to properly neutralize the user controlled parameter. It is assumed that the function calling will appropriately quote and sanitize the user input. However, two locations have been identified that can be reached through the action on th

Affected

  • cpe suitecrm/suitecrmversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-29099

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-29099

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the function in fails to properly neutralize the user controlled parameter. I

    nvd.nist.gov

References