CVE-2026-69135 in SuiteCRM
要約
〜によって MITRE • 2026年11月05日
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Project module interpolates the authenticated caller's duplicateId POST parameter directly into a SQL query without sanitization, quoting, or parameterization. An authenticated attacker can alter query structure and disclose sensitive database information. This issue is fixed in versions 7.15.2 and 8.10.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.