CVE-2025-64493

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 8.6.0 through 8.9.0, there is an authenticated, blind (time-based) SQL-injection inside the appMetadata-operation of the GraphQL-API. This allows extraction of arbitrary data from the database, and does not require administrative access. This issue is fixed in version 8.9.1.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
SuiteCRM	SuiteCRM-Core	>= 8.6.0, < 8.9.1

References

Timeline

Published: Nov 8, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-644944.6Soft Serve is a self-hostable Git server for the command line. In versions prior to 0.10.0, there are several places where the user can inse CVE-2025-644955.4Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. In versions 0.6.34 and below, the functio CVE-2025-644968.0Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code CVE-2025-644976.5Tuleap is an Open Source Suite for management of software development and collaboration. Versions below 17.0.99.1762431347 of Tuleap Commun CVE-2025-644984.3Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap Community Edition versions below 17.0.99.176 CVE-2025-644995.4Tuleap is a free and open source suite for management of software development and collaboration. Tuleap Community Editon versions prior to 1 CVE-2025-64509.8A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0. It has been classified as critical. This affects an u CVE-2025-645007.3Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines CVE-2025-645017.6ProsemirrorToHtml is a JSON converter which takes ProseMirror-compatible JSON and outputs HTML. In versions 0.2.0 and below, the `prosemirro CVE-2025-645026.9Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. The MongoDB `explain()` method provi CVE-2025-645033.3cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other tha CVE-2025-645045.0Langfuse is an open source large language model engineering platform. Starting in version 2.70.0 and prior to versions 2.95.11 and 3.124.1,