high7.2Public exploit code
CVE-2024-58258
SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- SugarCRM 14.0.0 - SSRF/Code Injection2025-07-16 · webapps · multiple
Impact
SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| SugarCRM | SugarCRM | before 13.0.4 |
| 14.X | before 14.0.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.