CVE-2021-25960

In “SuiteCRM” application, v7.11.18 through v7.11.19 and v7.10.29 through v7.10.31 are affected by “CSV Injection” vulnerability (Formula Injection). A low privileged attacker can use accounts module to inject payloads in the input fields. When an administrator access accounts module to export the data as a CSV file and opens it, the payload gets executed. This was not fixed properly as part of CVE-2020-15301, allowing the attacker to bypass the security measure.

• CWE-1236
• CWE-1236

• https://github.com/salesagility/SuiteCRM/commit/7124482fe07ee164923d974456ed31e45f65e513Patch, Third Party Advisory
• https://github.com/salesagility/SuiteCRM/commit/f463031bee59676d7d5be53bb32d551cd70a5648Patch, Third Party Advisory
• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25960Third Party Advisory
• https://github.com/salesagility/SuiteCRM/commit/7124482fe07ee164923d974456ed31e45f65e513Patch, Third Party Advisory
• https://github.com/salesagility/SuiteCRM/commit/f463031bee59676d7d5be53bb32d551cd70a5648Patch, Third Party Advisory
• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25960Third Party Advisory

Published

Sep 29, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-25954In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or…4.3
• CVE-2021-25955In “Dolibarr ERP CRM”, WYSIWYG Editor module, v2.8.1 to v13.…9
• CVE-2021-25956In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 ha…7.2
• CVE-2021-25957In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable …8.8
• CVE-2021-25958In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a…7.5
• CVE-2021-25959In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to…6.1
• CVE-2021-25961In “SuiteCRM” application, v7.1.7 through v7.10.31 and v7.11…8
• CVE-2021-25962“Shuup” application in versions 0.4.2 to 2.10.8 is affected …8.8
• CVE-2021-25963In Shuup, versions 1.6.0 through 2.10.8 are vulnerable to re…6.1
• CVE-2021-25964In “Calibre-web” application, v0.6.0 to v0.6.12, are vulnera…5.4
• CVE-2021-25965In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to C…8.8
• CVE-2021-25966In “Orchard core CMS” application, versions 1.0.0-beta1-3383…8.8