Espocrm CVE-2018-17301

Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary local

PHP object deserialization in EspoCRM versions prior to 9.3.7 lets an authenticated administrator achieve remote code ex

Path traversal in EspoCRM's formula scripting engine allows authenticated administrators to achieve arbitrary file read/

EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any ext

EspoCRM 5.6.4 is vulnerable to user password hash enumeration. Rated high severity (CVSS 8.8), this vulnerability is rem

Authorization bypass in EspoCRM 5.8.5 lets an authenticated low-privilege user reuse or manipulate Basic-Authorization a

EspoCRM deployments before 10.0.5 allow an authenticated user with Email Account scope to retrieve other users' stored I

CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating

Boolean-based blind SQL injection in EspoCRM versions 8.1.0 through 9.3.7 allows an authenticated non-administrator to i

Path traversal in EspoCRM admin template management allows authenticated administrators to read, create, overwrite, or d

Server-side request forgery in EspoCRM before 10.0.4 allows authenticated users to route outbound HTTP requests to inter

Stored cross-site scripting in EspoCRM 9.3.3 and below enables an authenticated attacker to execute arbitrary JavaScript