CVE-2025-54785CWE-20

SuiteCRM is Vulnerable to PHP Object Injection in Reports

High · published August 6, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
31.0
In the wild
Unconfirmed
What it is

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, user-supplied input is not validated/sanitized before it is passed to the unserialize function, which could lead to penetration, privilege escalation, sensitive data exposure, Denial of Service, cryptomining and ransomware. This issue is fixed in version 7.14.7 and 8.8.1.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00382 · 31.0th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-08-06T23:15Z
EPSS history
Timeline
  • 06 AUG 23:15Z
    SuiteCRM is Vulnerable to PHP Object Injection in Reports
    cvelistv5