SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 5, 2026 · NIST NVD

   Detected

   SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries. Attackers can append SQL code to the record parameter in GET requests to the index.php endpoint to extract sensitive database information through time-based blind SQL injection techniques.

2. Oct 6, 2026 · NIST NVD

   Updated

   SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries. Attackers can append SQL code to the record parameter in GET requests to the index.php endpoint to extract sensitive database information through time-based blind SQL injection techniques.

Affected

• cpe salesagility/suitecrmversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2019-25664

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2019-25664

  SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries. Attackers can append SQL code to the record parameter in GET requests to the index.p

  nvd.nist.gov

References

• Product · suitecrm.com
• Product · suitecrm.com
• Exploit · exploit-db.com
• Third Party Advisory · vulncheck.com