CVE-2026-69141 · Package
NO FIX YET · SEE WHAT TO DO
SuiteCRM's Cases knowledge-base search passes the POST search parameter into a SQL query without proper escaping, because an XSS-style prefix makes the sanitizer return an unencoded string. A low-privileged user with Cases module access can extract sensitive database contents through blind SQL injection.
first public Aug 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
SuiteCRM installations before 7.15.2 and before 8.10.2 are exposed, through the Cases module's knowledge-base article search. The attacker needs a low-privileged account with access to the Cases module. Installations already on the fixed versions are not affected.
Not affected if fixed-version, no-cases-access
Who cares php, self-hosted, suitecrm
7.15.28.10.2SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the CasesController action_get_kb_articles action interpolates $_POST['search'] into a CASE WHEN ... LIKE expression and the SQL WHERE clause. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the encoded backup, allowing a literal quote to reach the query. A low-privileged user with Cases module access can perform blind SQL injection and extract sensitive database information. This issue is fixed in versions 7.15.2 and 8.10.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.