CVE-2022-23940

SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Scheduled Reports module can achieve this by leveraging PHP deserialization in the email_recipients property. By using a crafted request, they can create a malicious report, containing a PHP-deserialization payload in the email_recipients field. Once someone accesses this report, the backend will deserialize the content of the email_recipients field and the payload gets executed. Project dependencies include a number of interesting PHP deserialization gadgets (e.g., Monolog/RCE1 from phpggc) that can be used for Code Execution.

• CWE-502

• https://docs.suitecrm.com/8.x/admin/releases/8.0/Release Notes, Vendor Advisory
• https://github.com/manuelz120Exploit, Third Party Advisory
• https://docs.suitecrm.com/8.x/admin/releases/8.0/Release Notes, Vendor Advisory
• https://github.com/manuelz120Exploit, Third Party Advisory

Published

Mar 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23932Potential vulnerabilities have been identified in the system…8.2
• CVE-2022-23933Potential vulnerabilities have been identified in the system…8.2
• CVE-2022-23934Potential vulnerabilities have been identified in the system…8.2
• CVE-2022-23935lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a …7.8
• CVE-2022-23937In Wind River VxWorks 6.9 and 7, a specific crafted packet m…7.5
• CVE-2022-2394Puppet Bolt prior to version 3.24.0 will print sensitive par…3.5
• CVE-2022-23942Apache Doris, prior to 1.0.0, used a hardcoded key and IV to…7.5
• CVE-2022-23943Out-of-bounds Write vulnerability in mod_sed of Apache HTTP …9.8
• CVE-2022-23944User can access /plugin api without authentication. This iss…9.1
• CVE-2022-23945Missing authentication on ShenYu Admin when register by HTTP…7.5
• CVE-2022-23946A stack-based buffer overflow vulnerability exists in the Ge…7.8
• CVE-2022-23947A stack-based buffer overflow vulnerability exists in the Ge…7.8