CVE-2025-41384

Cross-Site Scripting (XSS) vulnerability reflected in SuiteCRM v7.14.1. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP Referer header to include an arbitrary domain with malicious JavaScript code at the end. The server will attempt to block the arbitrary domain but will allow the JavaScript code to execute.

• CWE-79

• https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-suitecrmThird Party Advisory

Published

Oct 27, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-41376CRLF Injection vulnerability in Limesurvey v2.65.1+170522.  …5.3
• CVE-2025-41377A SQL injection vulnerability has been found in Gandia Integ…8.7
• CVE-2025-41378The SSID field is not parsed correctly and can be used to in…6.9
• CVE-2025-41379The Intellian C700 web panel allows you to add firewall rule…6.3
• CVE-2025-4138Allows the extraction filter to be ignored, allowing symlink…7.5
• CVE-2025-41380Iridium Certus 700 version 1.0.1 has an embedded credentials…6.1
• CVE-2025-41385An OS Command Injection issue exists in wivia 5 all versions…7.2
• CVE-2025-41388Fuji Electric Smart Editor is vulnerable to a stack-based bu…8.4
• CVE-2025-4139A vulnerability classified as critical was found in Netgear …8.8
• CVE-2025-41390An arbitrary code execution vulnerability exists in the git …7.8
• CVE-2025-41391Stored cross-site scripting vulnerability exists in multiple…5.4
• CVE-2025-41392In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt S…8.4