Back to Database
Status published
Medium
CVE-2025-41384
Reflected Cross-Site Scripting (XSS) in SuiteCRM
Vulnerability Description
Cross-Site Scripting (XSS) vulnerability reflected in SuiteCRM v7.14.1. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP Referer header to include an arbitrary domain with malicious JavaScript code at the end. The server will attempt to block the arbitrary domain but will allow the JavaScript code to execute.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-41384
Credits & Attribution
No credits recorded in the NVD database.
References
More from SuiteCRM
View All →CVE-2025-64493
SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL
Medium
6.5
CVE-2025-64492
SuiteCRM is Vulnerable to Authenticated Time Based Blind SQL Injection
High
8.8
CVE-2025-64491
SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page
Medium
6.1
CVE-2025-64490
SuiteCRM's Inconsistent RBAC Enforcement Enables Access Control Bypass
High
8.3
CVE-2025-64489
SuiteCRM: Privilege Escalation via Improper Session Invalidation and Inactive User Bypass
High
8.3
Affected Vendor
SuiteCRM
View all reports →Affected Software
SuiteCRM
Vulnerable Versions:
versions prior to 7.14.1 and prior to 8.8.1
Timeline
Official Publish:
October 27th, 2025
Last Modified:
October 27th, 2025
Added to House:
July 22nd, 2026