CVE-2018-17784: SugarCRM

Medium severity, CVSS 6.1. EPSS: 4.4% chance of exploitation in the next 30 days.

Multiple vulnerabilities in YUI and FlashCanvas embedded in SugarCRM Community Edition 6.5.26 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system.

Affected products

• SugarCRM SugarCRM: from 6.5.0, up to and including 6.5.26

Published 2018-10-10. Last modified 2026-06-17.