CVE-2017-14510: SugarCRM

Medium severity, CVSS 6.1. EPSS: 1.4% chance of exploitation in the next 30 days.

An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). The WebToLeadCapture functionality is found vulnerable to unauthenticated cross-site scripting (XSS) attacks. This attack vector is mitigated by proper validating the redirect URL values being passed along.

Affected products

• SugarCRM SugarCRM: up to and including 7.7.2.2; version 6.5.26 only; version 7.8.0.0 only; version 7.8.0.1 only; version 7.8.1.0 only; version 7.8.2.0 only; …

Published 2017-09-17. Last modified 2026-06-17.