What’s Vulnerable › Vulnerabilities

CVE-2025-54788: SuiteCRM: Authenticated Blind SQL Injection in InboundEmail module

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-07 · updated 2026-06-17
• Weakness: CWE-89

Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions and below, the InboundEmail module allows the arbitrary execution of queries in the backend database, leading to SQL injection. This can have wide-reaching implications on confidentiality, integrity, and availability, as database data can be retrieved, modified, or removed entirely. This issue is fixed in version 7.14.7.

Affected products

• salesagility SuiteCRM: before 7.14.7 — fixed in 7.14.7

How to fix

Upgrade to a fixed version: salesagility SuiteCRM 7.14.7. Check the vendor advisory for mitigations.

References

• https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_7
• https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-v3m9-8wg7-c72x

Get alerted when CVE-2025-54788 or the next vulnerability affects your stack