CVE-2025-64491: SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and below allow unauthenticated reflected Cross-Site Scripting (XSS). Successful exploitation could lead to full account takeover, for example by altering the login form to send credentials to an attacker-controlled server. As a reflected XSS issue, exploitation requires the victim to open a crafted malicious link, which can be delivered via phishing, social media, or other communication channels. This issue is fixed in version 7.14.8.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64491?
CVE-2025-64491 has a high severity rating due to its potential for unauthenticated reflected Cross-Site Scripting leading to account takeover.
How do I fix CVE-2025-64491?
To fix CVE-2025-64491, upgrade to a version of SuiteCRM that is above 7.14.7 where the vulnerability has been addressed.
What is CVE-2025-64491?
CVE-2025-64491 is a vulnerability in SuiteCRM allowing unauthenticated reflected Cross-Site Scripting, which could lead to full account takeover.
Which versions of SuiteCRM are affected by CVE-2025-64491?
Versions of SuiteCRM up to and including 7.14.7 are affected by CVE-2025-64491.
What impact does CVE-2025-64491 have on users?
The impact of CVE-2025-64491 is significant as it can allow attackers to perform account takeover and manipulate user data.