PT-2026-26444 · Suitecrm · Suitecrm

Yamerooo123 · Publicado 2026-03-19 · Atualizado 2026-03-20 · CVE-2026-29106

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.1 SuiteCRM versions prior to 8.9.3

Description SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the return id request parameter's value is copied into an HTML tag attribute, specifically an event handler, which is enclosed in double quotation marks. This can lead to a cross-site scripting (XSS) issue.

Recommendations Update to SuiteCRM version 7.15.1 or later. Update to SuiteCRM version 8.9.3 or later. Implement a Content Security Policy (CSP) header to mitigate XSS.

Exploit

Correção

Improper Encoding or Escaping of Output

XSS

Enumeração de Fraquezas

CWE-116

CWE-80

CWE-79

CWE-159

Identificadores relacionados

CVE-2026-29106

GHSA-7QRJ-5HJ6-7C2M

Produtos afetados

Suitecrm

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29106.json · Exploit
• https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-7qrj-5hj6-7c2m · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-29106 · Aviso do Fabricante
• https://docs.suitecrm.com/admin/releases/7.15.x · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-29106 · Nota de Segurança
• https://twitter.com/CVEnew/status/2034841507073806701 · Publicação no Twitter