EspoCRM EUVD-2026-95018

Requires that the EspoCRM Lead Capture public form feature be enabled and externally reachable - the injection vector is the public form submission, so instances without an exposed Lead Capture form are not exploitable. The payload only takes effect when a privileged administrator subsequently opens the affected LeadCaptureLogRecord in the admin UI (the UI:P / passive-interaction requirement), so there is no immediate attacker-controlled trigger. Impact is further limited by Content Security Policy, which blocks JavaScript execution, confining the issue to stored HTML/markup injection (content and UI spoofing) rather than full script-based XSS or session theft.

This is a genuinely low-to-moderate risk issue rather than a top-tier priority, and the signals are broadly consistent. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P/VC:N/VI:L/VA:N) and the 5.3 Medium score align with the description: network-reachable, no attacker authentication (PR:N), but dependent on passive user interaction (UI:P) - an administrator must open the log record for the injected HTML to render. Only integrity is affected and only at Low (VI:L); there is no confidentiality or availability impact, which fits the description's note that Content Security Policy blocks JavaScript execution, reducing this from a classic stored XSS to stored HTML injection (content/UI spoofing, not script execution). Exploitation status: publicly available exploit code exists (GitHub security advisory referenced as an exploit), but this is NOT in CISA KEV and there is no evidence of active exploitation - do not conflate POC availability with in-the-wild use. EPSS score was not provided in the input, so the statistical exploitation-probability signal is unavailable and cannot be weighed. No SSVC decision data was supplied. Net: a credible, easy-to-trigger but low-impact flaw whose real-world severity is capped by CSP and by the requirement that a privileged user view the malicious record.

An unauthenticated attacker locates a publicly exposed EspoCRM Lead Capture form and submits crafted form data containing HTML markup, which is stored verbatim in the LeadCaptureLogRecord.data field. When an administrator later opens that log record in the CRM UI, the attacker-supplied HTML is rendered unescaped, enabling UI spoofing, misleading content, or phishing-style injection; CSP prevents accompanying JavaScript from executing. Public exploit code for this technique is available via the vendor's GitHub security advisory.