Vulnerability · Published Feb 24, 2025 · Assigned by VulDB

CVE-2025-1618vTiger CRM index.php cross site scripting

Medium 4.3

In plain English

A medium-severity cross-site scripting in CRM from vTiger. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 65.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in vTiger CRM 6.4.0/6.5.0 and classified as problematic. This vulnerability affects unknown code of the file /modules/Mobile/index.php. The manipulation of the argument _operation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0 is able to address this issue. It is recommended to upgrade the affected component.

Affected products (as reported)

Vendor	Product	Versions
vTiger	CRM	6.4.06.5.0

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

VDB-296608 | vTiger CRM index.php cross site scripting vdb-entry, technical-description
VDB-296608 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #501840 | vtiger Vtiger CRM 6.4.0 Reflected Cross-Site Scripting third-party-advisory
https://www.vtiger.com/ product