Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-61648

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, a user-controllable Multi report condition passes parameter_value through unencodeMultienum() and concatenates the result into a SQL WHERE clause. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the encoded backup, allowing a literal quote to reach the database. A low-privileged user with AOR Reports access can read arbitrary tables through time-based or UNION-based SQL injection and can consume database connections with delay expressions. This issue is fixed in versions 7.15.2 and 8.10.2.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 16.1%
CVSS Severity
CVSS v3 Score 8.3
Products affected by CVE-2026-61648


Contact Us

Shodan ® - All rights reserved