PT-2025-32237 · Suitecrm · Suitecrm

Paul1278 · Published 2025-08-07 · Updated 2025-08-12 · CVE-2025-54784

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SuiteCRM versions 7.14.0 through 7.14.6

Description SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. A Cross Site Scripting (XSS) vulnerability exists in the email viewer. An external attacker could send a prepared message to the inbox of the SuiteCRM instance. By viewing emails as a logged-in user, the payload can be triggered, allowing an attacker to run arbitrary actions as that user – potentially extracting data or taking over the instance if the logged-in user is an administrator.

Recommendations Update to SuiteCRM version 7.14.7.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-54784

GHSA-VG8Q-XCQ5-MH3P

Affected Products

Suitecrm

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54784.json · Exploit
• https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-vg8q-xcq5-mh3p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54784 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54784 · Security Note
• https://t.me/CVEtracker/29409 · Telegram Post
• https://twitter.com/CveFindCom/status/1953262303639425354 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1953321675434418259 · Twitter Post
• https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_7 · Note
• https://t.me/cveNotify/131957 · Telegram Post