What’s Vulnerable › Vulnerabilities
CVE-2025-64492: SuiteCRM is Vulnerable to Authenticated Time Based Blind SQL Injection
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-11-08 · updated 2026-06-17
- Weakness: CWE-89
Description
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 8.9.0 and below contain a time-based blind SQL Injection vulnerability. This vulnerability allows an authenticated attacker to infer data from the database by measuring response times, potentially leading to the extraction of sensitive information. It is possible for an attacker to enumerate database, table, and column names, extract sensitive data, or escalate privileges. This is fixed in version 8.9.1.
Affected products
- salesagility SuiteCRM: from 8.0.0 before 8.9.1 — fixed in 8.9.1
How to fix
Upgrade to a fixed version: salesagility SuiteCRM 8.9.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-64492 or the next vulnerability affects your stack