CVE-2025-54783

MEDIUM

SuiteCRM < 7.14.7 - Reflected Cross-Site Scripting via HTTP Referer Header

Title source: llm

Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP Referer header to include some arbitrary domain with malicious JavaScript code at the end. The server will attempt to block the arbitrary domain but allow the JavaScript code to execute. This is fixed in version 7.14.7.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_confirm

https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-vqrj-gp9m-8c6r

Release Notes x_refsource_misc

https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_7

Scores

CVSS v3 6.1

EPSS 0.0020

EPSS Percentile 10.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

salesagility/suitecrm < 7.14.7

Published Aug 07, 2025

Tracked Since Feb 18, 2026