CyberSec.Space Logo
Back to CVE Browser

CVE-2023-46815

HIGH
8.8
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2023-10-27
Last Modified2026-06-17
Data SourcesNVD

Vulnerability Description

An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. An Unrestricted File Upload vulnerability has been identified in the Notes module. By using a crafted request, custom PHP code can be injected via the Notes module because of missing input validation. An attacker with regular user privileges can exploit this.

Affected Platforms (CPE)

📦
Sugarcrm

Sugarcrm

>= 12.0.0 and < 12.0.4= 13.0.0= 13.0.1

References & Advisories

🔗 https://support.sugarcrm.com/resources/security/sugarcrm-sa-2023-011/
🔗 https://support.sugarcrm.com/resources/security/sugarcrm-sa-2023-011/

Related Vulnerabilities

CVE-2025-133614.3

The Web to SugarCRM Lead plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1....

CVE-2024-582587.2

SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur.

CVE-2025-250349.3

A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to imp...

CVE-2023-468168.8

An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. A Server Site Template Injection (SSTI) vulnerability h...