CVSS: 6.0EPSS: 1%CPEs: 9EXPL: 3CVE-2009-2146 – SugarCRM 5.2.0e - Remote Code Execution
https://notcve.org/view.php?id=CVE-2009-2146
Unrestricted file upload vulnerability in the Compose Email feature in the Emails module in Sugar Community Edition (aka SugarCRM) before 5.2f allows remote authenticated users to execute arbitrary code by uploading a file with only an extension in its name, then accessing the file via a direct request to a modified filename under cache/modules/Emails/, as demonstrated using .php as the entire original name. Vulnerabilidad de subida de fichero sin restricción en la caracteristica Compose Email del módulo Emails in Sugar Community Edition (también conocido como SugarCRM) versión anterior a 5.2f permite a atacantes remotos ejecutar código de su elección subiendo un fichero con una extensión ejecutable, posteriormente accediendo al fichero mediante una petición directa a un fichero modificado del directorio cache/modules/Emails/, como se ha demostrado al usar .php como el nombre completo original • https://www.exploit-db.com/exploits/8949 http://secunia.com/advisories/35445 http://www.securityfocus.com/bid/35361 http://www.sugarforge.org/frs/download.php/5598/Sugar_CommunityEdition_ReleaseNotes_5.2f.pdf http://www.ush.it/team/ush/hack-sugarcrm_520e/adv.txt •
CVSS: 6.8EPSS: 3%CPEs: 1EXPL: 0CVE-2006-6712
https://notcve.org/view.php?id=CVE-2006-6712
Cross-site scripting (XSS) vulnerability in SugarCRM Open Source 4.5.0f and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in crafted email messages. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en SugarCRM Open Source 4.5.0f y anteriores permite a un atacante remoto inyectar secuencias de comandos web o HTML a través de vectores no especificados en mensajes de correo manipulados. • http://dl.sugarforge.org/sugardocs/Notes/ReleaseNotes/SugarOpenSource_ReleaseNotes_4.5.0g.pdf http://jvn.jp/jp/JVN%2374079537/index.html http://secunia.com/advisories/23424 http://securitytracker.com/id?1017434 http://www.securityfocus.com/bid/21694 http://www.vupen.com/english/advisories/2006/5100 •
CVSS: 6.4EPSS: 3%CPEs: 4EXPL: 4CVE-2006-2460 – Sugar Suite Open Source 4.2 - 'OptimisticLock' Command Execution
https://notcve.org/view.php?id=CVE-2006-2460
Sugar Suite Open Source (SugarCRM) 4.2 and earlier, when register_globals is enabled, does not protect critical variables such as $_GLOBALS and $_SESSION from modification, which allows remote attackers to conduct attacks such as directory traversal or PHP remote file inclusion, as demonstrated by modifying the GLOBALS[sugarEntry] parameter. • https://www.exploit-db.com/exploits/1785 http://retrogod.altervista.org/sugar_suite_42_incl_xpl.html http://secunia.com/advisories/20072 http://securityreason.com/securityalert/921 http://securitytracker.com/id?1016087 http://www.osvdb.org/25532 http://www.securityfocus.com/archive/1/434009/100/0/threaded http://www.securityfocus.com/bid/17987 http://www.vupen.com/english/advisories/2006/1791 https://exchange.xforce.ibmcloud.com/vulnerabilities/26451 •
CVSS: 4.3EPSS: 0%CPEs: 13EXPL: 0CVE-2005-0266
https://notcve.org/view.php?id=CVE-2005-0266
Cross-site scripting (XSS) vulnerability in index.php in SugarCRM 1.X allows remote attackers to inject arbitrary web script or HTML via the (1) return_module, (2) return_action, (3) name, (4) module, or (5) record parameter. • http://marc.info/?l=bugtraq&m=110461706232174&w=2 http://www.securityfocus.com/bid/12113 https://exchange.xforce.ibmcloud.com/vulnerabilities/18719 •
CVSS: 10.0EPSS: 0%CPEs: 13EXPL: 2CVE-2004-1225 – SugarCRM 1.x/2.0 Module - 'record' SQL Injection
https://notcve.org/view.php?id=CVE-2004-1225
SQL injection vulnerability in SugarCRM Sugar Sales before 2.0.1a allows remote attackers to execute arbitrary SQL commands and gain privileges via the record parameter in a DetailView action to index.php, and record parameters in other functionality. • https://www.exploit-db.com/exploits/24768 http://marc.info/?l=bugtraq&m=110295433323795&w=2 http://www.gulftech.org/?node=research&article_id=00053-120104 http://www.securityfocus.com/bid/11740 https://exchange.xforce.ibmcloud.com/vulnerabilities/18325 •