CVSS: 8.8EPSS: 7%CPEs: 9EXPL: 3CVE-2009-2146 – SugarCRM 5.2.0e - Remote Code Execution
https://notcve.org/view.php?id=CVE-2009-2146
22 Jun 2009 — Unrestricted file upload vulnerability in the Compose Email feature in the Emails module in Sugar Community Edition (aka SugarCRM) before 5.2f allows remote authenticated users to execute arbitrary code by uploading a file with only an extension in its name, then accessing the file via a direct request to a modified filename under cache/modules/Emails/, as demonstrated using .php as the entire original name. Vulnerabilidad de subida de fichero sin restricción en la caracteristica Compose Email del módulo Em... • https://www.exploit-db.com/exploits/8949 •
CVSS: 7.5EPSS: 9%CPEs: 2EXPL: 1CVE-2008-2045 – SugarCRM Community Edition 4.5.1/5.0.0 - File Disclosure
https://notcve.org/view.php?id=CVE-2008-2045
01 May 2008 — Absolute path traversal vulnerability in SugarCRM Sugar Community Edition 4.5.1 and 5.0.0 allows remote attackers to read arbitrary files via a full path in the URL parameter to modules/Feeds/Feed.php, which places the contents into a related cache file in the .cache/feeds directory. Vulnerabilidad de salto de ruta absoluta en SugarCRM Sugar Community Edition 4.5.1 y 5.0.0, permite a atacantes remotos leer los ficheros que deseen escribiendo una ruta completa en el parámetro URL de modules/Feeds/Feed.php, e... • https://www.exploit-db.com/exploits/5521 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •