CVE-2025-41384 - Reflected Cross-Site Scripting (XSS) in SuiteCRM

Back Back to CVE browser

MEDIUM

Reflected Cross-Site Scripting (XSS) in SuiteCRM

Published Oct 27, 2025

5.1

MEDIUM

CVSS 4.0

EPSS 0.19%

Description

Cross-Site Scripting (XSS) vulnerability reflected in SuiteCRM v7.14.1. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP Referer header to include an arbitrary domain with malicious JavaScript code at the end. The server will attempt to block the arbitrary domain but will allow the JavaScript code to execute.

Affected products

Vendor SuiteCRM Product SuiteCRM Default
unaffected
- Version
  versions prior to 7.14.1 and prior to 8.8.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SuiteCRM

unaffected

Version	Status	Constraints
versions prior to 7.14.1 and prior to 8.8.1	affected	-

Remediation

Vendor solution

The vulnerabilities have been fixed by the SuiteCRM team in versions 7.14.7 and 8.8.1.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-36178
Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-suitecrm
Third Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-36178		Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-suitecrm		Third Party Advisory