CVE-2015-5946: SugarCRM

High severity, CVSS 7.8. EPSS: 1.7% chance of exploitation in the next 30 days.

Incomplete blacklist vulnerability in SuiteCRM 7.2.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension.

Affected products

• SugarCRM SugarCRM: version 6.5.22 only

Published 2017-08-07. Last modified 2026-06-17.