CVE-2022-50589

9.3 criticalEPSS 0.7%

Critical (9.3) in salesagility suitecrm. EPSS 0.7% chance of exploitation in the next 30 days.

SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within the processing of the ‘uid’ parameter within the ‘export’ functionality. Successful exploitation allows remote unauthenticated attackers to ultimately execute arbitrary code.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2025-11-06
Modified: 2026-07-15
Record from: the NVD, synced 2026-10-19

Affected

salesagility:suitecrm

References

https://blog.exodusintel.com/2022/06/09/salesagility-suitecrm-export-request-sql-injection-vulnerability/
https://docs.suitecrm.com/admin/releases/7.12.x/#_7_12_6
https://www.vulncheck.com/advisories/suitecrm-sqli-via-export-functionality

Check your stack JSON