CVE-2021-45903: Salesagility Suitecrm

Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days.

A persistent cross-site scripting (XSS) issue in the web interface of SuiteCRM before 7.10.35, and 7.11.x and 7.12.x before 7.12.2, allows a remote attacker to introduce arbitrary JavaScript via attachments upload, a different vulnerability than CVE-2021-39267 and CVE-2021-39268.

Affected products

• Salesagility Suitecrm: before 7.10.35 (fixed in 7.10.35); from 7.11.0, before 7.12.2 (fixed in 7.12.2)

Published 2021-12-28. Last modified 2026-06-17.