Vulnerability details
CVE-2026-69142
SuiteCRM SuiteCRM
SuiteCRM: Authenticated SQL Injection in map_markers distance Parameter
CVSS 3.1
8.8High
Official description
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the jjwg_Maps map marker endpoint uses the authenticated caller's distance value in the map_markers action without strict numeric validation or parameterization. An authenticated attacker can alter the SQL query, extract database data, modify query results, and consume resources. This issue is fixed in versions 7.15.2 and 8.10.2.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.8High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| SuiteCRM | SuiteCRM | < 7.15.2 | CVEProject cvelistV5 (CNA) |
| SuiteCRM | SuiteCRM | >= 8.0.0, < 8.10.2 | CVEProject cvelistV5 (CNA) |
References and advisories
5- https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-pjc8-2w2x-xcgf x_refsource_CONFIRM
- https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68 x_refsource_MISC
- https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c x_refsource_MISC
- https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2 x_refsource_MISC
- https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2 x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-11-05
- Last updated
- 2026-11-05
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.35%
Probability of exploitation in 30 days
28.9%
Percentile (among all CVEs)
Weaknesses (CWE)
- CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')