CVE-2025-54783 - CVE House

Back to Database

Status published Medium CVE-2025-54783

SuiteCRM: Reflected Cross Site Scripting (XSS) through HTTP Referrer header

5.1 CVSS

Vulnerability Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP Referer header to include some arbitrary domain with malicious JavaScript code at the end. The server will attempt to block the arbitrary domain but allow the JavaScript code to execute. This is fixed in version 7.14.7.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-54783

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from SuiteCRM

View All →

SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL

SuiteCRM is Vulnerable to Authenticated Time Based Blind SQL Injection

SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page

SuiteCRM's Inconsistent RBAC Enforcement Enables Access Control Bypass

SuiteCRM: Privilege Escalation via Improper Session Invalidation and Inactive User Bypass

Affected Vendor

SuiteCRM

View all reports →

Affected Software

SuiteCRM

Vulnerable Versions:

< 7.14.7

Timeline

Official Publish: August 7th, 2025

Last Modified: August 7th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement