CVE-2019-17317

7.2 highEPSS 1.4%

High (7.2) in sugarcrm sugarcrm. EPSS 1.4% chance of exploitation in the next 30 days.

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard module by an Admin user.

Severity

7.2 high

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
CWE: CWE-1321
Published: 2019-10-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19