CVE-2020-28956: SugarCRM

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in the Sales module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary address state or alternate address state input fields.

Affected products

• SugarCRM SugarCRM: version 6.5.18 only

Published 2021-10-22. Last modified 2026-06-17.