CVE-2025-54784: SuiteCRM is vulnerable to Cross Site Scripting (XSS) through its email viewer
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. There is a Cross Site Scripting (XSS) vulnerability in the email viewer in versions 7.14.0 through 7.14.6. An external attacker could send a prepared message to the inbox of the SuiteCRM-instance. By simply viewing emails as the logged-in user, the payload can be triggered. With that, an attacker is able to run arbitrary actions as the logged-in user - like extracting data, or if it is an admin executing the payload, takeover the instance. This is fixed in versions 7.14.7.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54784?
The severity of CVE-2025-54784 is classified as high due to its potential for cross-site scripting attacks.
How do I fix CVE-2025-54784?
To fix CVE-2025-54784, upgrade SuiteCRM to version 7.14.7 or later.
Which versions of SuiteCRM are impacted by CVE-2025-54784?
Versions 7.14.0 through 7.14.6 of SuiteCRM are impacted by CVE-2025-54784.
What type of vulnerability is CVE-2025-54784?
CVE-2025-54784 is a cross-site scripting (XSS) vulnerability.
Can CVE-2025-54784 be exploited remotely?
Yes, CVE-2025-54784 can be exploited remotely by sending a specially crafted message.