CVE-2019-17299: SugarCRM

High severity, CVSS 7.2. EPSS: 1.4% chance of exploitation in the next 30 days.

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by an Admin user.

Affected products

• SugarCRM SugarCRM: from 7.9.0.0, before 7.9.5.0 (fixed in 7.9.5.0); from 8.0.0, before 8.0.4 (fixed in 8.0.4); from 9.0.0, before 9.0.2 (fixed in 9.0.2)

Published 2019-10-07. Last modified 2026-06-17.