7.11.10

DATE	CVE	VULNERABILITY TITLE	RISK
2020-11-18	CVE-2020-14208	Cross-site Scripting vulnerability in Salesagility Suitecrm SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting (XSS) in the Documents preview functionality. network low complexity salesagility CWE-79	5.4
2020-11-18	CVE-2020-15301	Improper Neutralization of Formula Elements in a CSV File vulnerability in Salesagility Suitecrm SuiteCRM through 7.11.13 allows CSV Injection via registration fields in the Accounts, Contacts, Opportunities, and Leads modules. local low complexity salesagility CWE-1236	7.8
2020-11-06	CVE-2020-28328	Unrestricted Upload of File with Dangerous Type vulnerability in Salesagility Suitecrm SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. network low complexity salesagility CWE-434	8.8
2020-03-16	CVE-2020-8787	Improper Input Validation vulnerability in Salesagility Suitecrm SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow for an invalid Bean ID to be submitted. network low complexity salesagility CWE-20	7.5
2020-03-16	CVE-2020-8786	SQL Injection vulnerability in Salesagility Suitecrm SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 4 of 4). network low complexity salesagility CWE-89 critical	9.8
2020-03-16	CVE-2020-8785	SQL Injection vulnerability in Salesagility Suitecrm SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 3 of 4). network low complexity salesagility CWE-89 critical	9.8
2020-03-16	CVE-2020-8784	SQL Injection vulnerability in Salesagility Suitecrm SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 2 of 4). network low complexity salesagility CWE-89 critical	9.8
2020-03-16	CVE-2020-8783	SQL Injection vulnerability in Salesagility Suitecrm SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 1 of 4). network low complexity salesagility CWE-89 critical	9.8
2020-02-13	CVE-2020-8804	SQL Injection vulnerability in Salesagility Suitecrm SuiteCRM through 7.11.10 allows SQL Injection via the SOAP API, the EmailUIAjax interface, or the MailMerge module. network low complexity salesagility CWE-89	6.5
2020-02-13	CVE-2020-8803	Path Traversal vulnerability in Salesagility Suitecrm SuiteCRM through 7.11.11 allows Directory Traversal to include arbitrary .php files within the webroot via add_to_prospect_list. network low complexity salesagility CWE-22 critical	9.8