CVE-2025-54788

HIGH

SuiteCRM < 7.14.7 - SQL Injection in InboundEmail Module

Title source: llm
STIX 2.1

Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions and below, the InboundEmail module allows the arbitrary execution of queries in the backend database, leading to SQL injection. This can have wide-reaching implications on confidentiality, integrity, and availability, as database data can be retrieved, modified, or removed entirely. This issue is fixed in version 7.14.7.

References (2)

Core 2
Core References

Scores

CVSS v3 8.8
EPSS 0.0038
EPSS Percentile 29.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-89
Status published
Products (1)
salesagility/suitecrm < 7.14.7
Published Aug 07, 2025
Tracked Since Feb 18, 2026