Skip to content
OpenAdvisories
High WID-SEC-2025-2516 4 CVEs

SuiteCRM: Mehrere Schwachstellen ermöglichen Manipulation von Dateien

Published Nov 6, 2025 · Updated Nov 9, 2025 · Revision 2 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in SuiteCRM ausnutzen, um Dateien zu manipulieren, Sicherheitsmaßnahmen zu umgehen, erweiterte Berechtigungen zu erlangen oder Cross-Site-Scripting-Angriffe durchzuführen.

Product

SuiteCRM ist eine Open-Source-Customer-Relationship-Management-Anwendung (CRM) zur Verwaltung von Kundenbeziehungen.

Vulnerabilities 4

  • High 8.6
    CVE-2025-64488

    SuiteCRM: Authenticated SQL Injection Possible in Reschedule Call Module

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.7 and below and 8.0.0-beta.1 through 8.9.0 8.0.0-beta.1, an attacker can craft a malicious call_id that alters the logic of the SQL quer…

    Suite CRM SuiteCRM
  • High 8.3
    CVE-2025-64489

    SuiteCRM: Privilege Escalation via Improper Session Invalidation and Inactive User Bypass

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0 contain a privilege escalation vulnerability where user sessions are not invalidated upon account d…

    Suite CRM SuiteCRM
  • High 8.3
    CVE-2025-64490

    SuiteCRM's Inconsistent RBAC Enforcement Enables Access Control Bypass

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0 allow a low-privileged user with a restrictive role to view and create work items through the Resou…

    Suite CRM SuiteCRM
  • Medium 6.1
    CVE-2025-64491

    SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and below allow unauthenticated reflected Cross-Site Scripting (XSS). Successful exploitation could lead to full account takeover, for ex…

    Suite CRM SuiteCRM

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2025-38348, EUVD-2025-38332, EUVD-2025-38349, EUVD-2025-38347

  2. #1

    Initiale Fassung

References