CVSS: 8.8EPSS: 0%CPEs: 9EXPL: 3CVE-2009-2146 – SugarCRM 5.2.0e - Remote Code Execution
https://notcve.org/view.php?id=CVE-2009-2146
22 Jun 2009 — Unrestricted file upload vulnerability in the Compose Email feature in the Emails module in Sugar Community Edition (aka SugarCRM) before 5.2f allows remote authenticated users to execute arbitrary code by uploading a file with only an extension in its name, then accessing the file via a direct request to a modified filename under cache/modules/Emails/, as demonstrated using .php as the entire original name. Vulnerabilidad de subida de fichero sin restricción en la caracteristica Compose Email del módulo Em... • https://www.exploit-db.com/exploits/8949 •
CVSS: 6.8EPSS: 1%CPEs: 1EXPL: 0CVE-2006-6712
https://notcve.org/view.php?id=CVE-2006-6712
23 Dec 2006 — Cross-site scripting (XSS) vulnerability in SugarCRM Open Source 4.5.0f and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in crafted email messages. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en SugarCRM Open Source 4.5.0f y anteriores permite a un atacante remoto inyectar secuencias de comandos web o HTML a través de vectores no especificados en mensajes de correo manipulados. • http://dl.sugarforge.org/sugardocs/Notes/ReleaseNotes/SugarOpenSource_ReleaseNotes_4.5.0g.pdf •
CVSS: 9.1EPSS: 7%CPEs: 4EXPL: 4CVE-2006-2460 – Sugar Suite Open Source 4.2 - 'OptimisticLock' Command Execution
https://notcve.org/view.php?id=CVE-2006-2460
19 May 2006 — Sugar Suite Open Source (SugarCRM) 4.2 and earlier, when register_globals is enabled, does not protect critical variables such as $_GLOBALS and $_SESSION from modification, which allows remote attackers to conduct attacks such as directory traversal or PHP remote file inclusion, as demonstrated by modifying the GLOBALS[sugarEntry] parameter. • https://www.exploit-db.com/exploits/1785 •