PT-2025-7700 · Unknown · Vtiger Crm

Stux · Published 2025-02-24 · Updated 2026-01-29 · CVE-2025-1618

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions vTiger CRM version 6.4.0

Description A problematic issue has been identified, affecting the /modules/Mobile/index.php file. The manipulation of the operation argument leads to cross-site scripting. This issue can be exploited remotely.

Recommendations For version 6.4.0, as a temporary workaround, consider restricting access to the /modules/Mobile/index.php file until a patch is available. Avoid manipulating the operation argument in the affected file to minimize the risk of exploitation.

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

BDU:2025-14401

CVE-2025-1618

Affected Products

Vtiger Crm

References · 12

• https://bdu.fstec.ru/vul/2025-14401 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1618 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1618 · Security Note
• https://t.me/cvenotify/113062 · Telegram Post
• https://vtiger.com · Note
• https://vuldb.com/?id.296608 · Note
• https://vuldb.com/?ctiid.296608 · Note
• https://twitter.com/CVEnew/status/1893886171534802956 · Twitter Post
• https://vuldb.com/?submit.501840 · Note
• https://t.me/cveNotify/150234 · Telegram Post
• https://t.me/cvedetector/18784 · Telegram Post
• https://t.me/cvenotify/112214 · Telegram Post