CVE Feed

    Dashboard / CVE / CVE-2026-97377

    CVE-2026-97377

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portal_get_entry_list propagates caller-controlled where and order_by values into SQL query construction without sufficient neutralization. A low-privileged portal API user can perform blind SQL injection to disclose database metadata and sensitive records, affect query behavior, and consume resources. This issue is fixed in versions 7.15.2 and 8.10.2.

    Published:Nov 5, 2026
    Last Modified:Nov 5, 2026
    EPS:Nov 5, 2026
    EPSS Score:
    CVSS Score:8.8

    Affected Products

    Vendor
    Suitecrm
    Product
    Suitecrm

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-100358 (CVSS 9.4) — SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prio…
    CVE-2026-100363 (CVSS 8.8) — SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prio…
    CVE-2026-100359 (CVSS 6.5) — SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prio…
    CVE-2026-100362 (CVSS 6.9) — SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prio…
    CVE-2026-100360 (CVSS 7.1) — SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prio…
    CVE-2026-100361 (CVSS 7.1) — SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prio…
    CVE-2026-100364 (CVSS 7.1) — SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prio…
    CVE-2026-100365 (CVSS 8.8) — SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prio…
    CVE-2026-71548 (CVSS 8.8) — SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prio…
    CVE-2026-71550 (CVSS 9.9) — SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prio…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-97377 — Suitecrm (High 8.8) | CVE-DB