CVE-2019-25663

SuiteCRM 7.10.7 contains a SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the parentTab parameter. Attackers can send GET requests to the email module with malicious parentTab values using boolean-based SQL injection techniques to extract sensitive database information.

CVSS 4.0

7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 27% of CVEs (scores of 2026-10-25)

CWE

CWE-89

Published

2026-04-05

Modified

2026-10-06

Record from

the NVD, synced 2026-10-19

Affected

• salesagility:suitecrm

References

• https://suitecrm.com/
• https://suitecrm.com/download/
• https://www.exploit-db.com/exploits/46310
• https://www.vulncheck.com/advisories/suitecrm-sql-injection-via-parenttab-parameter

Check your stackJSON