Back to search
CVE-2025-41384
Published: Oct 27, 2025
Modified: Oct 27, 2025
PUBLISHED
Description
Cross-Site Scripting (XSS) vulnerability reflected in SuiteCRM v7.14.1. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP Referer header to include an arbitrary domain with malicious JavaScript code at the end. The server will attempt to block the arbitrary domain but will allow the JavaScript code to execute.
| Vendor | Product | Versions |
|---|---|---|
SuiteCRM | SuiteCRM | affected versions prior to 7.14.1 and prior to 8.8.1 |
Weaknesses (CWE)
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now