PT-2025-26454

🗓️ 20 Jun 2025 00:00:00Reported by Positive TechnologiesType

ptsecurity

ptsecurity🔗 dbugs.ptsecurity.com👁 2 Views

SugarCRM has PHP object injection vulnerability allowing code execution, update to secure versions.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2025-25034	29 May 201815:50	–	circl
CNNVD	SugarCRM 安全漏洞	20 Jun 202500:00	–	cnnvd
CVE	CVE-2025-25034	20 Jun 202518:34	–	cve
Cvelist	CVE-2025-25034 SugarCRM PHP Deserialization RCE	20 Jun 202518:34	–	cvelist
EUVD	EUVD-2025-18782	3 Oct 202520:07	–	euvd
Nuclei	SugarCRM - Unauthenticated Remote Code Execution via PHP Object Injection	3 Jun 202606:04	–	nuclei
NVD	CVE-2025-25034	20 Jun 202519:15	–	nvd
OpenVAS	SugarCRM PHP Object Injection Vulnerability (Jun 2016)	8 Jul 201600:00	–	openvas
RedhatCVE	CVE-2025-25034	23 Jun 202508:39	–	redhatcve
VulnCheck KEV	VulnCheck KEV: CVE-2025-25034	20 Jun 202500:00	–	vulncheck_kev

Source	Link
twitter	www.twitter.com/VulmonFeeds/status/1936266976596255000
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-25034
sugarcrm	www.sugarcrm.com/crm
karmainsecurity	www.karmainsecurity.com/KIS-2016-07
github	www.github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/sugarcrm_rest_unserialize_exec.rb
web	www.web.archive.org/web/20160725194502/http://sugarcrm.com/security/sugarcrm-sa-2016-008
twitter	www.twitter.com/0dayPublishing/status/1991245092254798142
raw	www.raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/sugarcrm_rest_unserialize_exec.rb
twitter	www.twitter.com/CVEnew/status/1936472539733045620
web	www.web.archive.org/web/20160508053502/http://sugarcrm.com/security/sugarcrm-sa-2016-001

19 Nov 2025 00:00Current

7.9High risk

Vulners AI Score7.9

CVSS 49.3

EPSS0.71497

SSVC

vulnerability php object injection sugarcrm update versions code execution