Vulnerability Description
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions and below, the InboundEmail module allows the arbitrary execution of queries in the backend database, leading to SQL injection. This can have wide-reaching implications on confidentiality, integrity, and availability, as database data can be retrieved, modified, or removed entirely. This issue is fixed in version 7.14.7.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Salesagility | Suitecrm | < 7.14.7 |
Related Weaknesses (CWE)
References
- https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_7Release Notes
- https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-v3m9-8wg7-c72xThird Party Advisory
FAQ
What is CVE-2025-54788?
CVE-2025-54788 is a vulnerability with a CVSS score of 8.8 (HIGH). SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions and below, the InboundEmail module allows the arbitrary execution of queries in th...
How severe is CVE-2025-54788?
CVE-2025-54788 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-54788?
Check the references section above for vendor advisories and patch information. Affected products include: Salesagility Suitecrm.