CVE-2021-45903

A persistent cross-site scripting (XSS) issue in the web interface of SuiteCRM before 7.10.35, and 7.11.x and 7.12.x before 7.12.2, allows a remote attacker to introduce arbitrary JavaScript via attachments upload, a different vulnerability than CVE-2021-39267 and CVE-2021-39268.

• CWE-79

• https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_35Release Notes, Vendor Advisory
• https://docs.suitecrm.com/admin/releases/7.12.x/#_7_12_2Release Notes, Vendor Advisory
• https://github.com/ach-ing/cves/blob/main/CVE-2021-45903.mdThird Party Advisory
• https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_35Release Notes, Vendor Advisory
• https://docs.suitecrm.com/admin/releases/7.12.x/#_7_12_2Release Notes, Vendor Advisory
• https://github.com/ach-ing/cves/blob/main/CVE-2021-45903.mdThird Party Advisory

Published

Dec 28, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-45896Nokia FastMile 3TG00118ABAD52 devices allow privilege escala…8.8
• CVE-2021-45897SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows remote co…8.8
• CVE-2021-45898SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows local fil…9.8
• CVE-2021-45899SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows PHAR dese…9.8
• CVE-2021-45900Vivoh Webinar Manager before 3.6.3.0 has improper API authen…6.5
• CVE-2021-45901The password-reset form in ServiceNow Orlando provides diffe…5.3
• CVE-2021-45904OpenWrt 21.02.1 allows XSS via the Port Forwards Add Name sc…5.4
• CVE-2021-45905OpenWrt 21.02.1 allows XSS via the Traffic Rules Name screen…5.4
• CVE-2021-45906OpenWrt 21.02.1 allows XSS via the NAT Rules Name screen.5.4
• CVE-2021-45907An issue was discovered in gif2apng 1.9. There is a stack-ba…7.8
• CVE-2021-45908An issue was discovered in gif2apng 1.9. There is a stack-ba…7.8
• CVE-2021-45909An issue was discovered in gif2apng 1.9. There is a heap-bas…7.8