CVE-2018-20816

An XSS combined with CSRF vulnerability discovered in SalesAgility SuiteCRM 7.x before 7.8.24 and 7.10.x before 7.10.11 leads to cookie stealing, aka session hijacking. This issue affects the "add dashboard pages" feature where users can receive a malicious attack through a phished URL, with script executed.

• CWE-79
• CWE-352

• https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_11Release Notes, Vendor Advisory
• https://docs.suitecrm.com/admin/releases/7.8.x/#_7_8_24Release Notes, Vendor Advisory
• https://github.com/salesagility/SuiteDocs/pull/198/filesPatch, Third Party Advisory
• https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_11Release Notes, Vendor Advisory
• https://docs.suitecrm.com/admin/releases/7.8.x/#_7_8_24Release Notes, Vendor Advisory
• https://github.com/salesagility/SuiteDocs/pull/198/filesPatch, Third Party Advisory

Published

Apr 5, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-20810Session data between cluster nodes during cluster synchroniz…
• CVE-2018-20811A hidden RPC service issue was found with Pulse Secure Pulse…
• CVE-2018-20812An information exposure issue where IPv6 DNS traffic would b…
• CVE-2018-20813An input validation issue has been found with login_meeting.…
• CVE-2018-20814An XSS issue was found with Psaldownload.cgi in Pulse Secure…
• CVE-2018-20815In QEMU 3.1.0, load_device_tree in device_tree.c calls the d…
• CVE-2018-20817SV_SteamAuthClient in various Activision Infinity Ward Call …
• CVE-2018-20818A buffer overflow vulnerability was discovered in the OpenPL…
• CVE-2018-20819io/ZlibCompression.cc in the decompression component in Drop…
• CVE-2018-2082Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-20820read_ujpg in jpgcoder.cc in Dropbox Lepton 1.2.1 allows atta…
• CVE-2018-20821The parsing component in LibSass through 3.5.5 allows attack…6.5