CVE-2025-41384: Reflected Cross-Site Scripting (XSS) in SuiteCRM

Published Oct 27, 2025

Updated

Cross-Site Scripting (XSS) vulnerability reflected in SuiteCRM v7.14.1. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP Referer header to include an arbitrary domain with malicious JavaScript code at the end. The server will attempt to block the arbitrary domain but will allow the JavaScript code to execute.

Affected Software

2 affected components

SuiteCRM SuiteCRM

SalesAgility SuiteCRM=7.14.1

Remediation

Information

The vulnerabilities have been fixed by the SuiteCRM team in versions 7.14.7 and 8.8.1.

Event History

Oct 27, 2025

CVE Published

via MITRE·12:53 PM

Data Sourced

via MITRE·12:53 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·01:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-41384?

CVE-2025-41384 has been classified as a moderate severity vulnerability due to its potential for allowing cross-site scripting attacks.

How do I fix CVE-2025-41384?

To fix CVE-2025-41384, upgrade to the patched version of SuiteCRM where the XSS vulnerability has been addressed.

What versions of SuiteCRM are affected by CVE-2025-41384?

CVE-2025-41384 affects SuiteCRM version 7.14.1 and potentially other versions if not updated.

What are the risks associated with CVE-2025-41384?

The main risk of CVE-2025-41384 is that it allows attackers to execute arbitrary JavaScript code in the context of the user's browser session.

Can CVE-2025-41384 be exploited remotely?

Yes, CVE-2025-41384 can be exploited remotely if an attacker can manipulate the HTTP Referer header.