CVE-2026-29100 HIGH

CVE-2026-29100: SuiteCRM has Reflected HTML Injection in Login Page via default_user_name Parameter

Vendor Suitecrm
Product SuiteCRM
Weakness CWE-79 · XSS
Published March 19, 2026
Last update March 21, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

What the vulnerability does

01Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. SuiteCRM 7.15.0 contains a reflected HTML injection vulnerability in the login page that allows attackers to inject arbitrary HTML content, enabling phishing attacks and page defacement. Version 7.15.1 patches the issue.

Key dates

02Disclosure timeline

March 19, 2026 CVE published
March 21, 2026 Record updated