CVE-2025-1618

Summary

CVE-2025-1618 is a newly disclosed vulnerability that impacts the vTiger CRM 6.4.0 and 6.5.0 versions. The issue lies within the unknown code of the /modules/Mobile/index.php file and is classified as a cross-site scripting (XSS) vulnerability. An attacker can exploit this flaw by manipulating the _operation argument, which allows them to inject malicious scripts remotely. The exploit is currently public, increasing the risk of attacks. To mitigate this vulnerability, users are advised to upgrade to vTiger CRM 7.0 as soon as possible.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.