CVE-2017-14510

An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). The WebToLeadCapture functionality is found vulnerable to unauthenticated cross-site scripting (XSS) attacks. This attack vector is mitigated by proper validating the redirect URL values being passed along.

• CWE-79

• https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/Exploit, Third Party Advisory
• https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-008/Vendor Advisory
• https://www.synology.com/support/security/Synology_SA_17_53_SugarCRM
• https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/Exploit, Third Party Advisory
• https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-008/Vendor Advisory
• https://www.synology.com/support/security/Synology_SA_17_53_SugarCRM

Published

Sep 17, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-14505DrawGetStrokeDashArray in wand/drawing-wand.c in ImageMagick…
• CVE-2017-14506geminabox (aka Gem in a Box) before 0.13.6 has XSS, as demon…5.4
• CVE-2017-14507Multiple SQL injection vulnerabilities in the Content Timeli…
• CVE-2017-14508An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x be…
• CVE-2017-14509An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x be…
• CVE-2017-1451IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.…
• CVE-2017-14511An issue was discovered in SAP E-Recruiting (aka ERECRUIT) 6…
• CVE-2017-14512NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage…
• CVE-2017-14513Directory traversal vulnerability in MetInfo 5.3.17 allows r…
• CVE-2017-14514Directory Traversal on Tenda W15E devices before 15.11.0.14 …
• CVE-2017-14515Heap-based Buffer Overflow on Tenda W15E devices before 15.1…
• CVE-2017-14516Cross-Site Scripting (XSS) exists in SAP Business Objects Fi…