Trending
CVE-2023-22952

CVE detail

CVE-2023-22952

In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.

CVSS 8.8 · HighBuzz score 52.6KEV listed

Buzz score

Why this CVE is surfacing

Buzz score total 52.6

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 16.1 · diversity 11.5 · KEV 25.0 · OTX 0.0 · PoC 0.0

Mention score

16.1

4 evidence mentions in the snapshot

Diversity score

11.5

3 sources across 2 categories

KEV score

25.0

Known exploited vulnerability present

OTX score

0.0

0 OTX pulses

PoC score

0.0

0 repos · best confidence N/A

Best PoC traction

Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions: 0; within the 30d window
Peak daily: 0; highest bucket

Evidence

Source links by recency

Newest mentions first

4 source links · newest first

When a Zero Day and Access Keys Collide in the Cloud: Responding to the SugarCRM Zero-Day VulnerabilityUnit42
Threat actors used SugarCRM's zero-day CVE-2023-22952 and cloud account misconfigurations to access credentials. We offer prevention advice.
vendorunit42.paloaltonetworks.comAug 10, 2023, 10:15 PM
CISA adds Oracle, SugarCRM bugs to its Known Exploited Vulnerabilities CatalogSecurity Affairs
US CISA added actively exploited vulnerabilities in SugarCRM and Oracle products to its Known Exploited Vulnerabilities Catalog. The Cybersecurity and Infrastructure Security Agency (CISA) added Oracle and SugarCRM flaws, respectively tracked as CVE-2022-21587 and CVE-2023-22952, to its Known Exploited Vulnerabilities Catalog. The CVE-2022-21587 flaw (CVSS score 9.8) affects the Oracle E-Business Suite, which is a set […]
newssecurityaffairs.comFeb 4, 2023, 6:45 PM
Exploitation of Oracle E-Business Suite Vulnerability Starts After PoC PublicationSecurityWeek
Critical Oracle E-Business Suite vulnerability exploited in attacks shortly after PoC is published.
newswww.securityweek.comFeb 3, 2023, 11:28 AM
Recently Disclosed Vulnerability Exploited to Hack Hundreds of SugarCRM ServersSecurityWeek
Exploitation of a critical vulnerability affecting the widely used SugarCRM customer relationship management system was seen just days after someone made public an exploit.
newswww.securityweek.comJan 12, 2023, 11:16 AM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars

No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence

CVE-2020-7472
An authorization bypass and PHP local-file-include vulnerability in the installation component of SugarCRM before 8.0, 8.0 before 8.0.7, 9.0 before 9.0.4, and 10.0 before 10.0.0 a…
CVSS 9.8 · Critical
CVE-2026-47668
DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the…
CVSS 10.0 · Critical
3 mentions
CVE-2026-54133
jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP data structures. Versio…
CVSS 9.8 · Critical
1 mention
CVE-2026-45558
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the HAProxy section-save endpoints (POST /api/service/haproxy…
CVSS 9.9 · Critical
1 mention
CVE-2026-11218
Inappropriate implementation in PlatformIntegration in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gest…
CVSS 6.8 · Medium
2 mentions
CVE-2026-10904
Inappropriate implementation in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium…
CVSS 8.8 · High
2 mentions

External lookup

Potential internet exposure

Potential exposure only — not proof of vulnerability.Shodan results indicate potentially internet-exposed products, not confirmed vulnerable systems. They do not confirm that any returned system is vulnerable to CVE-2023-22952.

Product-level CPE searches intentionally omit version fields and NVD version-range or configuration certainty. Verify the exact product version and configuration independently.

Sign-in required. Shodan requires you to sign in to run these filter searches.

Product CPE queries

Derived from this CVE's existing NVD CPE 2.3 records; the application, operating-system, or hardware part is retained.

cpe:2.3:a:sugarcrm:sugarcrmSearch this product on Shodan

Exact CVE query

Eligible paid Shodan plan required

Shodan's exact vuln: filter is separate from the product searches above and requires an eligible paid Shodan plan.

vuln:CVE-2023-22952Search this CVE on Shodan

These are outbound search links only. cvebuzz makes no Shodan API call, uses no Shodan API key, and does not display live result counts.

Metadata

Canonical fields

NVD status

Unavailable

Published

Jan 11, 2023

Modified

Jun 17, 2026

Official record

Authoritative NVD record

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE IDs

Vendor classifications

How this vector reads

CVSS 3.1 base metrics decoded below. This explanation does not recalculate or change the NVD score.

Attack Vector (AV): Network. The vulnerable system can be reached across network boundaries.
Attack Complexity (AC): Low. No special conditions beyond the attacker-controlled steps are required.
Privileges Required (PR): Low. The attacker needs basic user-level privileges.
User Interaction (UI): None. Exploitation does not require another user to act.
Scope (S): Unchanged. Impacts remain within the vulnerable security authority.
Confidentiality Impact (C): High. There is a total or serious impact to this security property.
Integrity Impact (I): High. There is a total or serious impact to this security property.
Availability Impact (A): High. There is a total or serious impact to this security property.

Signals

Exploitation indicators

1 stored signals · KEV present · 0 OTX pulses

KEVKEV
- cwes: CWE-20
- dueDate: 2023-02-23
- knownRansomwareCampaignUse: Unknown
- notes: https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-001/; https://nvd.nist.gov/vuln/detail/CVE-2023-22952
- product: Multiple Products
- requiredAction: Apply updates per vendor instructions.
- shortDescription: Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.
- vendorProject: SugarCRM
- vulnerabilityName: Multiple SugarCRM Products Remote Code Execution Vulnerability
Observed Feb 2, 2023, 12:00 AM