SugarCRM versions 9.0.1 and below suffer from multiple reflective cross site scripting vulnerabilities.