SuiteCRM 7.15.0 contains a reflected HTML injection flaw in the login page that allows attackers to inject arbitrary HTML through the default_user_name parameter. This capability can be used for phishing attacks, page defacement, and potentially misleading users into submitting credentials to a malicious site.

The vulnerability is present in SuiteCRM 7.15.0. A patch is available in version 7.15.1, which removes the reflected injection code from the login page.

The CVSS score of 7.1 indicates moderate severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is the publicly accessible login page, as the default_user_name parameter is part of the login form. Based on the description, it is inferred that an attacker could craft a malicious link that, when clicked by a user, injects harmful HTML into the login page, leading to phishing or defacement. No additional prerequisites beyond web access are specified by the vendor.