Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-100359

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Project Template module's action_get_end_date function interpolates authenticated caller-controlled task_id and lag POST parameters directly into SQL without sanitization, parameterization, or escaping. Any authenticated user can perform blind SQL injection to read customer data, internal communications, credentials, and other database contents. This issue is fixed in versions 7.15.2 and 8.10.2.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 21.6%
CVSS Severity
CVSS v3 Score 6.5
Products affected by CVE-2026-100359


Contact Us

Shodan ® - All rights reserved