CVE-2019-25664CWE-89sql-injection

CVE-2019-25664

High · published April 6, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
26.5
In the wild
Unconfirmed
What it is

SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries. Attackers can append SQL code to the record parameter in GET requests to the index.php endpoint to extract sensitive database information through time-based blind SQL injection techniques.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00342 · 26.5th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-04-06T01:16Z
Affected products (1)
ProductVersionsFixed in
salesagility/suitecrm≤ 7.10.7—
References (4)
https://suitecrm.com/ · [email protected]https://suitecrm.com/download/ · [email protected]https://www.exploit-db.com/exploits/46311 · [email protected]https://www.vulncheck.com/advisories/suitecrm-sql-injection-via-record-parameter · [email protected]
EPSS history
Timeline
  • 05 APR 20:45Z
    SuiteCRM 7.10.7 SQL Injection via record Parameter
    cvelistv5