What is CVE-2025-64492?

CVE-2025-64492 is a high-severity vulnerability in Salesagility Suitecrm, classified under SQL Injection. CVSS score: 8.8/10. Published 2025-11-08.

How severe is CVE-2025-64492?

High severity. CVSS v3 base score is 8.8 out of 10.

SQL Injection in Salesagility Suitecrm

CVE-2025-64492

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 8.9.0 and below contain a time-based blind SQL Injection vulnerability. This vulnerability allows an authenticated attacker to infer data from the database by measuring response times, potentially leading to the extraction of sensitive information. It is possible for an attacker to enumerate database, table, and column names, extract sensitive data, or escalate privileges. This is fixed in version 8.9.1.

Vulnerability class: SQL Injection

EPSS: 0.003 (26.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Salesagility Suitecrm
Suitecrm Suitecrm-core — versions < 8.9.1

Weakness classification (CWE)

CWE-89 — SQL Injection

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2025-64492?: CVE-2025-64492 is a high-severity vulnerability in Salesagility Suitecrm, classified under SQL Injection. CVSS score: 8.8/10. Published 2025-11-08.
How severe is CVE-2025-64492?: High severity. CVSS v3 base score is 8.8 out of 10.