{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-19T00:10:12.929","vulnerabilities":[{"cve":{"id":"CVE-2026-29105","sourceIdentifier":"security-advisories@github.com","published":"2026-03-19T23:16:43.327","lastModified":"2026-03-24T14:10:38.800","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, SuiteCRM contains an unauthenticated open redirect vulnerability in the WebToLead capture functionality. A user-supplied POST parameter is used as a redirect destination without validation, allowing attackers to redirect victims to arbitrary external websites. This vulnerability allows attackers to abuse the trusted SuiteCRM domain for phishing and social engineering attacks by redirecting users to malicious external websites. Versions 7.15.1 and 8.9.3 patch the issue."},{"lang":"es","value":"SuiteCRM es una aplicación de software de Gestión de Relaciones con Clientes (CRM) de código abierto y lista para empresas. Antes de las versiones 7.15.1 y 8.9.3, SuiteCRM contiene una vulnerabilidad de redirección abierta no autenticada en la funcionalidad de captura WebToLead. Un parámetro POST proporcionado por el usuario se utiliza como destino de redirección sin validación, permitiendo a los atacantes redirigir a las víctimas a sitios web externos arbitrarios. Esta vulnerabilidad permite a los atacantes abusar del dominio de confianza de SuiteCRM para ataques de phishing e ingeniería social, redirigiendo a los usuarios a sitios web externos maliciosos. Las versiones 7.15.1 y 8.9.3 aplican un parche al problema."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-601"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:suitecrm:suitecrm:*:*:*:*:*:*:*:*","versionEndExcluding":"7.15.1","matchCriteriaId":"73648654-E7F6-47CF-8E01-19BBFF737C99"},{"vulnerable":true,"criteria":"cpe:2.3:a:suitecrm:suitecrm:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.9.3","matchCriteriaId":"C7E15DD3-A934-40A2-8B43-ABCCBB53CBCF"}]}]}],"references":[{"url":"https://docs.suitecrm.com/admin/releases/7.15.x","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-9crg-83cg-wv74","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}}]}