Description SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Configurator module by an Admin user. Remediation References CVE-2019-17306 Related Vulnerabilities Apache HTTP Server Other Vulnerability (CVE-2021-42013) WordPress Plugin Post SMTP-WP SMTP with Email Logs & Mobile App for Failure Alerts-Any SMTP Plus Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES, Postmark Cross-Site Scripting (2.7.0) IBM RTC Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-1570) WordPress 4.4.x Multiple Vulnerabilities (4.4 - 4.4.28) WordPress Plugin Broken Link Checker Cross-Site Scripting (1.10.1) Severity High Classification CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Tags Missing Update Known Vulnerabilities CWE-94 CVE-2019-17306