SuiteCRM through 7.11.10 allows SQL Injection via the SOAP API, the EmailUIAjax interface, or the MailMerge module.
{ "severity": "Medium", "cpes": [ "cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*" ] }