Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-100365

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR report generation concatenates an attacker-controlled stored field label into an ORDER BY clause without an allowlist. The affected flow begins at AOR_Reports and uses aor_fields, ORDER BY, and field label to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user with AOR Reports access can perform time-based extraction of password hashes and arbitrary table data and can hold database connections with expensive expressions. This issue is fixed in versions 7.15.2 and 8.10.2.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 38.6%
CVSS Severity
CVSS v3 Score 8.8
Products affected by CVE-2026-100365


Contact Us

Shodan ® - All rights reserved