CVE-2025-41384CWE-79cross-site-scripting

CVE-2025-41384

Medium · published October 27, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
8.6
In the wild
Unconfirmed
What it is

Cross-Site Scripting (XSS) vulnerability reflected in SuiteCRM v7.14.1. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP Referer header to include an arbitrary domain with malicious JavaScript code at the end. The server will attempt to block the arbitrary domain but will allow the JavaScript code to execute.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00194 · 8.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-10-27T17:15Z
Affected products (1)
ProductVersionsFixed in
salesagility/suitecrmall versions—
References (1)
https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-suitecrm · [email protected]
EPSS history
Timeline
  • 27 OCT 12:53Z
    Reflected Cross-Site Scripting (XSS) in SuiteCRM
    cvelistv5