CVE-2025-41384mediumCWE-79

CVE-2025-41384: fallo de gravedad media en SuiteCRM

Reflected Cross-Site Scripting (XSS) in SuiteCRM

Publicada el

Seguir esta CVE+ Monitorear SuiteCRM

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.1epss 0.2%
Cross-Site Scripting (XSS) vulnerability reflected in SuiteCRM v7.14.1. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP Referer header to include an arbitrary domain with malicious JavaScript code at the end. The server will attempt to block the arbitrary domain but will allow the JavaScript code to execute.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Productos afectados
SuiteCRM · SuiteCRM
CVEs relacionadas — SuiteCRM

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-69137HIGHSuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response DisclosureEPSS 3.8%CVE-2026-33289HIGHSuiterCRM has LDAP Filter Injection in Authentication ModuleEPSS 0.7%CVE-2022-50589CRITICALSuiteCRM < 7.12.6 SQL Injection via 'export' FunctionalityEPSS 0.7%CVE-2026-63213HIGHSuiteCRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SuiteCRMEPSS 0.6%CVE-2026-29103CRITICALSuiteCRM Vulnerable to Remote Code Execution via Module Loader Package Scanner BypassEPSS 0.5%CVE-2026-29102HIGHSuiteCRM has Authenticated RCE in ModulesEPSS 0.5%