CVE-2026-61653

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.2 SuiteCRM versions prior to 8.10.2

Description An authenticated user with access to Campaigns can perform time-based blind SQL injection against arbitrary database tables. The issue occurs in the modules/Campaigns/PopupCampaignRoi.php file, where the id variable from the $ REQUEST array is interpolated into a SQL query. While the securexss() function typically entity-encodes quotes, providing an input prefixed with an XSS payload causes AntiXSS to select a processed string instead of the entity-encoded backup, allowing a literal quote to reach the query.

Recommendations Update SuiteCRM to version 7.15.2 or later. Update SuiteCRM to version 8.10.2 or later.