CVE-2023-22952

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/171320/SugarCRM-12.x-Remote-Code-Execution-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-001/Vendor Advisory
http://packetstormsecurity.com/files/171320/SugarCRM-12.x-Remote-Code-Execution-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-001/Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22952US Government Resource

Timeline

Published: Jan 11, 2023
Last modified: Jun 17, 2026
Added to CISA KEV: Feb 2, 2023
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-229538.8In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user.CVE-2023-229557.8An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. The validation of firmware images only consists of simple checksu CVE-2023-229567.5An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of a hard-coded cryptographic key, an attacker is CVE-2023-229577.5An issue was discovered in libac_des3.so on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of hard-coded cryptographic key, CVE-2023-229586.1The Syracom Secure Login plugin before 3.1.1.0 for Jira may allow spoofing of 2FA PIN validation via the plugins/servlet/twofactor/public/pi CVE-2023-229598.8WebChess through 0.9.0 and 1.0.0.rc2 allows SQL injection: mainmenu.php, chess.php, and opponentspassword.php (txtFirstName, txtLastName).CVE-2023-22966.1The Loginizer WordPress plugin before 1.7.9 does not escape a parameter before outputting it back in the page, leading to a Reflected Cross-CVE-2023-229607.5Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency.CVE-2023-229635.3The personnummer implementation before 3.0.3 for Dart mishandles numbers in which the last four digits match the ^000[0-9]$ regular expressi CVE-2023-229649.1Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication i CVE-2023-22978.1The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions CVE-2023-229707.8Bottles before 51.0 mishandles YAML load, which allows remote code execution via a crafted file.