Description SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a Regular user. Remediation References CVE-2019-17316 Related Vulnerabilities WordPress Plugin Featured Content 'param' Parameter Cross-Site Scripting (0.0.1) WordPress Plugin WooCommerce Upload My File Cross-Site Request Forgery (0.3.9) axios Permissive List of Allowed Inputs Vulnerability (CVE-2026-42042) WordPress Plugin SP Rental Manager SQL Injection (1.5.3) Oracle JRE CVE-2011-3547 Vulnerability (CVE-2011-3547) Severity High Classification CVE-2019-17316 CWE-915 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Tags Missing Update Known Vulnerabilities