GCVE - cpe:2.3:a:salesagility:suitecrm:7.14.6:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:salesagility:suitecrm:7.14.6:*:*:*:*:*:*:*

part: a version: 7.14.6 update: *

Vendor	Salesagility (`916b6370-ebfb-5d4e-8dbe-d9e81235e5f5`)
Product	Suitecrm (`a221dfca-d49b-5c7f-8e45-fb4130d54600`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/salesagility/suitecrm`	purl2cpe	2026-06-01 10:13:42.188916
`pkg:suitecrm/suitecrm`	purl2cpe	2026-06-01 10:13:42.188917

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-54787`	vulnerable	2026-06-08 07:33:13.213134	SuiteCRM: Improper Authorization for attachment downloads LOW (3.7) SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. There is a vulnerability in SuiteCRM version 7.14.6 which allows unauthenticated downloads of any file from the upload-directory, as long as it is named by an ID (e.g. attachments). An unauthenticated attacker could download internal files when he discovers a valid file-ID. Valid IDs could be brute-forced, but this is quite time-consuming as the file-IDs are usually UUIDs. This issue is fixed in version 7.14.7. Published: 2025-08-07T21:15:39.708Z Updated: 2025-08-08T15:02:10.051Z Open on db.gcve.eu Reference links https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-8r72-224q-g9fv https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_7	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-54786`	vulnerable	2026-06-08 07:33:13.212534	SuiteCRM: Legacy iCal service allows unauthenticated access to meeting data MEDIUM (5.3) SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authentication in the legacy iCal service allows unauthenticated access to meeting data. An unauthenticated actor can view any user's meeting (calendar event) data given their username, related functionality allows user enumeration. This is fixed in versions 7.14.7 and 8.8.1. Published: 2025-08-06T23:23:00.948Z Updated: 2025-08-07T14:47:54.710Z Open on db.gcve.eu Reference links https://github.com/SuiteCRM/SuiteCRM-Core/security/advisories/GHSA-rf2v-4mv3-qcgm https://docs.suitecrm.com/8.x/admin/releases/8.8	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-54785`	vulnerable	2026-06-08 07:33:13.201642	SuiteCRM is Vulnerable to PHP Object Injection in Reports HIGH (8.8) SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, user-supplied input is not validated/sanitized before it is passed to the unserialize function, which could lead to penetration, privilege escalation, sensitive data exposure, Denial of Service, cryptomining and ransomware. This issue is fixed in version 7.14.7 and 8.8.1. Published: 2025-08-06T23:15:16.718Z Updated: 2025-08-07T14:48:26.266Z Open on db.gcve.eu Reference links https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-53cp-mpfw-qj67 https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_7	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.