CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
SugarCRM Remote Code Execution Vulnerability via EmailTemplates Input Validation Bypass (CVE-2023-22952)
[Affected Scope] SugarCRM versions prior to 12.0 without Hotfix 91155
[Impact] Authenticated attackers can inject arbitrary PHP code through crafted requests in the EmailTemplates module, leading to full remote code execution
[Mitigation] Apply SugarCRM Hotfix 91155 immediately or upgrade to version 12.0 or later
GLPI and htmLawed Remote Code Execution (RCE) Vulnerability Analysis and Mitigation Guide (CVE-2022-35914)
[Affected Scope] GLPI versions up to and including 10.0.2, specifically within the bundled htmLawed module
[Impact] Unauthenticated remote attackers can inject and execute arbitrary PHP code, leading to full system compromise
[Mitigation] Immediately upgrade GLPI to version 10.0.3 or higher, or delete the vulnerable test script (htmLawedTest.php)