CVSS: 8.8EPSS: 7%CPEs: 9EXPL: 3CVE-2009-2146 – SugarCRM 5.2.0e - Remote Code Execution
https://notcve.org/view.php?id=CVE-2009-2146
22 Jun 2009 — Unrestricted file upload vulnerability in the Compose Email feature in the Emails module in Sugar Community Edition (aka SugarCRM) before 5.2f allows remote authenticated users to execute arbitrary code by uploading a file with only an extension in its name, then accessing the file via a direct request to a modified filename under cache/modules/Emails/, as demonstrated using .php as the entire original name. Vulnerabilidad de subida de fichero sin restricción en la caracteristica Compose Email del módulo Em... • https://www.exploit-db.com/exploits/8949 •
CVSS: 6.8EPSS: 1%CPEs: 1EXPL: 0CVE-2006-6712
https://notcve.org/view.php?id=CVE-2006-6712
23 Dec 2006 — Cross-site scripting (XSS) vulnerability in SugarCRM Open Source 4.5.0f and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in crafted email messages. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en SugarCRM Open Source 4.5.0f y anteriores permite a un atacante remoto inyectar secuencias de comandos web o HTML a través de vectores no especificados en mensajes de correo manipulados. • http://dl.sugarforge.org/sugardocs/Notes/ReleaseNotes/SugarOpenSource_ReleaseNotes_4.5.0g.pdf •