Vulnerability details
CVE-2026-97377
SuiteCRM SuiteCRM
SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list
CVSS 3.1
8.8High
Official description
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portal_get_entry_list propagates caller-controlled where and order_by values into SQL query construction without sufficient neutralization. A low-privileged portal API user can perform blind SQL injection to disclose database metadata and sensitive records, affect query behavior, and consume resources. This issue is fixed in versions 7.15.2 and 8.10.2.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.8High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| SuiteCRM | SuiteCRM | < 7.15.2 | CVEProject cvelistV5 (CNA) |
| SuiteCRM | SuiteCRM | >= 8.0.0, < 8.10.2 | CVEProject cvelistV5 (CNA) |
References and advisories
5- https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-2hv5-wj8h-mv8m x_refsource_CONFIRM
- https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68 x_refsource_MISC
- https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c x_refsource_MISC
- https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2 x_refsource_MISC
- https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2 x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-11-05
- Last updated
- 2026-11-06
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.4%
Probability of exploitation in 30 days
34.9%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')