CVE-2025-64491: SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-11-08 · updated 2026-06-17
Weakness: CWE-79

Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and below allow unauthenticated reflected Cross-Site Scripting (XSS). Successful exploitation could lead to full account takeover, for example by altering the login form to send credentials to an attacker-controlled server. As a reflected XSS issue, exploitation requires the victim to open a crafted malicious link, which can be delivered via phishing, social media, or other communication channels. This issue is fixed in version 7.14.8.

Affected products

salesagility SuiteCRM: before 7.14.8 — fixed in 7.14.8

How to fix

Upgrade to a fixed version: salesagility SuiteCRM 7.14.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-64491 or the next vulnerability affects your stack