Back to CVE Browser

CVE-2023-22952

🔥 Known Exploited (CISA KEV)HIGH

8.8

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2023-01-11

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.

Affected Platforms (CPE)

📦

Sugarcrm

Sugarcrm

>= 11.0.0 and < 11.0.5>= 12.0.0 and < 12.0.2

References & Advisories

🔗 http://packetstormsecurity.com/files/171320/SugarCRM-12.x-Remote-Code-Execution-Shell-Upload.html

🔗 https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-001/

🔗 http://packetstormsecurity.com/files/171320/SugarCRM-12.x-Remote-Code-Execution-Shell-Upload.html

🔗 https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-001/

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22952

Related Vulnerabilities

CVE-2025-133614.3

The Web to SugarCRM Lead plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1....

CVE-2024-582587.2

SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur.

CVE-2025-250349.3

A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to imp...

CVE-2023-468168.8

An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. A Server Site Template Injection (SSTI) vulnerability h...