# CVE-2019-25663: SuiteCRM SQL injection in Emails module via parentTab parameter

Source: https://junglewise.ai/threats/cve-2019-25663-suitecrm-sql-injection-in-emails-module-via-parenttab-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-05. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2019-25663 · Severity: high · CVSS 7.1 · Published 2026-04-05

SuiteCRM, a popular open-source customer relationship management platform, contains a security flaw in its email module. An authenticated user can exploit this vulnerability to run unauthorized database commands, potentially leading to the theft of sensitive customer data or business information. This could result in significant data breaches and loss of proprietary information stored within the CRM.

Technologies: [Salesagility Suitecrm](https://junglewise.ai/threats/technologies/suitecrm). Vendors: [Salesagility](https://junglewise.ai/threats/vendors/salesagility).

## Quick answers

**Is CVE-2019-25663 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-25663 being exploited in the wild.

**How severe is CVE-2019-25663?** High severity, with a CVSS score of 7.1, published 5 April 2026.

**Which products and versions are affected?** Salesagility Suitecrm 7.10.7.

**Is there a fix for CVE-2019-25663?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2019-25663 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2019-25663?** Check whether you run Salesagility Suitecrm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A boolean-based SQL injection vulnerability exists in SuiteCRM version 7.10.7 within the 'Emails' module. The flaw is located in the handling of the 'parentTab' parameter during GET requests to index.php. An authenticated attacker can manipulate database queries by injecting malicious SQL code into this parameter, bypassing standard filters. This allows for the extraction of sensitive information from the underlying database. While the advisory focuses on version 7.10.7, users are encouraged to update to the latest stable maintenance releases (such as 7.14.x or 8.x) where these legacy issues are addressed.

## Affected products

- SalesAgility SuiteCRM 7.10.7

## Timeline

- 2019-02-04: disclosed: Original exploit published on Exploit-DB
- 2026-04-05: advisory: CVE-2019-25663 published/updated via VulnCheck and NVD

## References

- [https://suitecrm.com/](https://suitecrm.com/)
- [https://suitecrm.com/download/](https://suitecrm.com/download/)
- [https://www.exploit-db.com/exploits/46310](https://www.exploit-db.com/exploits/46310)
- [https://www.vulncheck.com/advisories/suitecrm-sql-injection-via-parenttab-parameter](https://www.vulncheck.com/advisories/suitecrm-sql-injection-via-parenttab-parameter)

## Related threats

- [SuiteCRM SQL injection in Users module record parameter](https://junglewise.ai/threats/cve-2019-25664-suitecrm-sql-injection-in-users-module-record-parameter)
- [SalesAgility SuiteCRM type confusion in deleteAttachment](https://junglewise.ai/threats/cve-2022-50590-salesagility-suitecrm-type-confusion-in-deleteattachment)
- [SalesAgility SuiteCRM SQL injection in export functionality](https://junglewise.ai/threats/cve-2022-50589-salesagility-suitecrm-sql-injection-in-export-functionality)
- [Cross-Site Scripting (XSS) vulnerability reflected in SuiteCRM v7.14.1. This vulnerability allows an attacker to…](https://junglewise.ai/threats/cve-2025-41384-cross-site-scripting-xss-vulnerability-reflected-in-suitecrm-v7)