Back to CVE Browser

CVE-2012-0694

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.0740%

EPSS Percentile34.67th

PublishedOct 29, 2019

Last ModifiedNov 21, 2024

Vulnerability Description

SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrary PHP code.

Affected Platforms (CPE)

📦

Sugarcrm

Sugarcrm

<= 6.3.1

References & Advisories

🔗 https://seclists.org/bugtraq/2012/Jun/165

🔗 https://security-tracker.debian.org/tracker/CVE-2012-0694

🔗 https://www.exploit-db.com/exploits/19381

🔗 https://seclists.org/bugtraq/2012/Jun/165

🔗 https://security-tracker.debian.org/tracker/CVE-2012-0694

🔗 https://www.exploit-db.com/exploits/19381

Related Vulnerabilities

CVE-2004-122510.0

SQL injection vulnerability in SugarCRM Sugar Sales before 2.0.1a allows remote attackers to execute arbitrary SQL commands and ga...

CVE-2004-122710.0

Directory traversal vulnerability in SugarCRM Sugar Sales 2.0.1c and earlier allows remote attackers to read arbitrary files and p...

CVE-2020-74729.8

An authorization bypass and PHP local-file-include vulnerability in the installation component of SugarCRM before 8.0, 8.0 before ...

CVE-2014-32449.8

XML external entity (XXE) vulnerability in the RSSDashlet dashlet in SugarCRM before 6.5.17 allows remote attackers to read arbitr...