CVE-2026-29100

6.1 mediumEPSS 0.2%

Medium (6.1) in suitecrm suitecrm. EPSS 0.2% chance of exploitation in the next 30 days.

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. SuiteCRM 7.15.0 contains a reflected HTML injection vulnerability in the login page that allows attackers to inject arbitrary HTML content, enabling phishing attacks and page defacement. Version 7.15.1 patches the issue.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 5% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-03-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

suitecrm:suitecrm

References

https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-g7hf-3j93-rwm5

Check your stack JSON