Espocrm
Monthly
Boolean-based blind SQL injection in EspoCRM versions 8.1.0 through 9.3.7 allows an authenticated non-administrator to inject crafted expressions through the 'where' parameter of the GET entity streamAttachments endpoint, enabling extraction of arbitrary database contents - including active administrator session tokens - and subsequent full privilege escalation. The flaw requires a valid low-privilege session (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, 7.6) and is not exploitable anonymously. Public exploit code exists for this issue, though it has not been confirmed as actively exploited (CISA KEV); EspoCRM 9.3.8 is the fixed release.
PHP object deserialization in EspoCRM versions prior to 9.3.7 lets an authenticated administrator achieve remote code execution by storing crafted serialized object data in background MassAction or Export parameters that the application later unserializes without any allowed-class restriction. The deserialization sinks are reachable over the network (AV:N) with no user interaction (UI:N), and an attacker with admin credentials can instantiate arbitrary PHP objects and execute code, provided a usable gadget chain is reachable in the deployed codebase or its dependencies. Publicly available exploit code exists, and the vendor released a fix in version 9.3.7; the practical limiting factor is the administrator-privilege prerequisite (PR:H), which tempers real-world urgency even though the flaw is rated 9.1.
EspoCRM deployments before 10.0.5 allow an authenticated user with Email Account scope to retrieve other users' stored IMAP passwords via an insecure direct object reference in PersonalAccount\Service, enabling mailbox compromise. Attackers must know or enumerate a victim's Email Account record ID, and publicly available exploit code exists; there is no confirmation of active exploitation (CISA KEV) at time of analysis. The vulnerability is a confidentiality-only issue with changed scope, rated high risk because it exposes reusable credentials.
Path traversal in EspoCRM admin template management allows authenticated administrators to read, create, overwrite, or delete arbitrary files on the server filesystem. The vulnerability affects all versions prior to 9.3.4 and stems from unsanitized `name` and `scope` parameters in template path construction. Publicly available exploit code exists (GitHub security advisory GHSA-44c3-xjfp-3jrh), though no CISA KEV listing or confirmed active exploitation. CVSS 7.2 reflects high impact across confidentiality, integrity, and availability, but exploitation requires high-privilege (admin) access, significantly limiting real-world exposure to insider threats or compromised admin credentials.
Path traversal in EspoCRM's formula scripting engine allows authenticated administrators to achieve arbitrary file read/write on the web server by manipulating attachment sourceId fields. The vulnerability chains unsanitized user input with filesystem operations, enabling admins to overwrite or access files anywhere within PHP's open_basedir restriction. Publicly available exploit code exists. Vendor-released patch version 9.3.4 addresses this critical issue. Despite the 9.1 CVSS score and Changed scope indicating potential container escape or cross-tenant impact, EPSS data was not provided to assess real-world exploitation likelihood.
An authorization bypass (IDOR) in EspoCRM's PDF rendering pipeline lets an authenticated low-privilege user read attachments they should not be able to access by supplying an arbitrary attachment ID as the image source of a PDF template. Affected versions are EspoCRM up to 9.3.10 and 10.0.10; the flaw resides in ImageSourceProvider::get (application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php) and is reached simply by rendering a template to PDF. Impact is limited to confidentiality of attachment data (CVSS 5.3, PR:L, no victim interaction), publicly available exploit code exists, and there is no indication of active exploitation in the wild.
EspoCRM installations prior to 10.0.2 allow an authenticated user holding the mass-update permission to duplicate an existing Attachment record by supplying its identifier, because the mass-update processor copied the file without performing an ACL read check - the resulting copy is then readable by the attacker, disclosing the file's contents. Impact is confidentiality-only (no integrity or availability effect) and exploitation is constrained: the attacker must already possess an elevated mass-update privilege and must know a valid attachment ID for a file they are not authorized to read, which the vendor acknowledges is difficult to obtain. Publicly available exploitation material exists in the form of the upstream advisory, the fix commit that pinpoints the vulnerable code path (Tools/MassUpdate/Processor.php), and the 10.0.2 release notes; there is no CISA KEV listing indicating confirmed active exploitation of this issue.
EspoCRM versions prior to 10.0.3 can disclose restricted record and user fields to an authenticated user who holds both email-template edit access and mass-email sending access, because the template renderer stops applying per-user ACL filtering when messages are generated for mass email and for administrator-controlled group-email auto-replies. Only fields explicitly marked FORBIDDEN, INTERNAL, or ONLY_ADMIN are exposed, so the impact is limited to information disclosure with no code execution, data modification, or availability loss, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (6.5, authenticated remote). Publicly available exploit code exists for this issue, but the prerequisite privilege pairing is not part of a typical default non-administrative role, keeping real-world priority at medium rather than urgent.
An authenticated administrator on EspoCRM instances prior to 9.3.10 can abuse the administrative Label Manager to read, modify, create, or delete JSON files outside the intended language directory by supplying crafted 'scope' and 'language' parameters. Exploitation requires a full administrator session (CVSS PR:H) and is bounded by filesystem permissions and server configuration, which limits the reachable files to those the PHP/web-server process can access, making this mainly a privilege-abuse and defense-in-depth concern rather than a path to arbitrary file compromise. Publicly available exploit code exists (the vendor's advisory and a fix commit were published), but there is no CISA KEV entry confirming active exploitation; EPSS data was not provided, so exploit likelihood should be treated as elevated but not critical.
Stored HTML injection in EspoCRM versions prior to 9.3.9 lets an unauthenticated remote sender place arbitrary HTML into the plain-text body of an email sent to a monitored group, IMAP, or email-to-Case mailbox; EspoCRM stores that body and renders it without escaping inside 'Email Received' stream notification emails delivered to users following the related record, allowing HTML injection and, in mail clients that execute embedded markup, JavaScript execution. Exploitation is constrained by the inbound-mail prerequisite, by required victim interaction (the follower must open the notification email, CVSS vector UI:R), and by mail-client behavior, yielding a moderate CVSS 3.1 score of 4.3 with limited integrity impact and no confidentiality or availability impact. Publicly available exploit code and the upstream fix commit are both public, but no confirmed active exploitation has been reported at time of analysis.
EspoCRM versions prior to 9.3.9 fail to neutralize spreadsheet formula triggers in exported CSV and XLSX files, because sanitizeCellValue() only inspects the first byte of a cell value. An authenticated low-privileged user can store free-text content such as " =cmd|' /C calc'!A0" (whitespace or a control character before the trigger), so the leading single-quote neutralization prefix is never applied; a separate privileged user must then export the affected records, open the file, and accept the spreadsheet application's formula/security prompts before the cell is evaluated, enabling outbound data disclosure and, on legacy configurations with DDE enabled, command execution. Tracked as CWE-1236 with CVSS 3.1 base score 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), and publicly available exploit code exists; no confirmed active exploitation (CISA KEV) was identified. This is a moderate, conditional risk best treated as a medium-priority hygiene fix rather than an urgent emergency.
Stored cross-site scripting in EspoCRM versions prior to 9.3.9 allows an authenticated user holding Email Template or PDF Template edit permission to persist crafted HTML that evades the moderateSanitizeHtml() filtering routine. The payload only executes when a second user opens the tampered template in edit mode on an instance where the non-default setting clientCspDisabled is true, at which point the attacker can hijack the victim's session; default deployments keep Content-Security-Policy enabled and are not affected. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV) and the vendor has shipped a fix in 9.3.9, making this a genuine but low-priority, non-default-configuration-dependent issue.
Stored cross-site scripting in EspoCRM (all versions prior to 9.3.9) lets an authenticated administrator inject JavaScript that executes in every user's browser session by placing crafted content in the applicationName setting and abusing CSP nonce injection. The payload is persisted in the main application page without escaping, so it executes for all users who load the application and can leak page data including unsaved form input. Publicly available exploit code exists, but exploitation requires the highest application privilege (administrator), and impact is limited to confidentiality (C:L) with no integrity or availability effect, making this a genuinely low-priority issue despite the available POC.
Broken object-level authorization in EspoCRM before 9.3.7 allows any authenticated user who has been granted Import scope access to read the row-level error CSV of another user's import job by posting to /api/v1/Import/{id}/exportErrors with a foreign import identifier. The endpoint returns an attachment identifier for the error file, exposing imported data rows (customer records, contact data, and similar) that the caller does not own; the exposure is limited to the contents of that import's error export and requires the attacker to know or enumerate a target import ID. Publicly available exploit code exists (the upstream advisory, fix commit, and 9.3.7 release are publicly linked), but there is no confirmed active exploitation via CISA KEV and no EPSS score was supplied; the vendor-released patch is 9.3.7, which adds the missing entity-level read check.
Unauthorized integrity change in EspoCRM before 9.3.7 lets an authenticated, low-privileged user flip the opted_out state on Contacts or Leads they are not permitted to read or edit, by calling the TargetList opt-out or cancel-opt-out action with record identifiers they do not legitimately control. The attacker must already hold a valid account with access to a shared TargetList, and the resulting impact is confined to the opt-out relationship flag on the targeted records - there is no confidentiality or availability impact, consistent with the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) and score of 4.3. Publicly available exploit code exists, the issue is fixed in EspoCRM 9.3.7, and there is no confirmed active exploitation (not in CISA KEV).
Information disclosure in EspoCRM's portal Note API allows an authenticated portal user (CVSS PR:L) who already has stream access to a parent record to retrieve internal agent notes by directly requesting a single Note by its known identifier; the stream list endpoint correctly filters notes where isInternal is true, but the direct single-Note read path fails to apply that restriction. Only EspoCRM versions prior to 9.3.7 are affected, and the issue is resolved in 9.3.7. Publicly available exploit code exists, but the practical risk is moderated by the preconditions: a valid portal credential, stream access to the relevant parent record, and knowledge of the specific note identifier - there is no described bulk enumeration, so exposure is per-known-identifier rather than wholesale dumping of internal content. No public exploit identified at time of analysis is contradicted here - exploitation code is public, but this is not confirmed as actively exploited (no CISA KEV listing).
An access-control bypass in EspoCRM 4.0.0 through 10.0.6 lets any authenticated user who already holds Stream access to a parent record read historical 'was'/'became' values of fields protected by field-level security, by calling the REST endpoint GET /Note/{id} directly, which skips the NoteAccessControl filter. Impact is limited to confidentiality (CVSS 4.0 base 5.3, VC:L with VI:N/VA:N; independently assessed as CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and is meaningful only in deployments that actually use field-level security to hide audited fields from lower-privilege users. Publicly available exploit code exists (GitHub advisory GHSA-mr36-xx82-qf6h, VulnCheck advisory), while there is no evidence of active exploitation or CISA KEV listing at time of analysis.
EspoCRM versions 4.0.0 through 10.0.6 allow authenticated users to read email addresses that Role-based field-level restrictions are supposed to conceal, because the address-book search API does not enforce the emailAddress field permission. An attacker only needs a valid account with record access plus a deployment that relies on Roles to hide emailAddress from that user; environments that do not restrict the field have nothing to leak. Publicly available exploit code exists, though the impact is read-only disclosure and the issue has been assessed as a medium-severity, low-urgency information exposure (CVSS 5.3) with no indication of confirmed active exploitation in the wild.
Authenticated EspoCRM users holding Import scope access can read other users' file attachments by abusing an insecure direct object reference in the Import module, allowing disclosure of files they do not own. The flaw affects EspoCRM releases before 10.0.7 and is reachable over the network by any logged-in account that has been granted the administrative Import permission; anonymous users and accounts without Import scope cannot trigger it. Exploitation requires knowledge or guessing of a valid foreign attachmentId, after which the attacker creates an Import record referencing that ID and calls the error-export endpoint to copy the referenced rows into a CSV they control. Publicly available exploit code exists, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms a confidentiality-only, medium-severity impact with no integrity or availability effect; no public exploit identified as confirmed actively exploited (CISA KEV) status was reported in the source data.
An authentication bypass in EspoCRM versions before 10.0.6 allows an attacker who already possesses a valid username and password for a two-factor-enabled account to stop at the second-factor prompt and still reach routes that do not enforce full authentication, exposing configuration parameters that are not otherwise publicly available. The CVSS vector carries PR:L, confirming the attack presupposes previously obtained first-factor credentials, so it provides no initial access on its own and the demonstrated impact is read-only confidentiality loss with no write, code execution, or account takeover. Publicly available exploit code exists and the vendor has released EspoCRM 10.0.6 as the fix, while CISA's SSVC assessment rates exploitation as none and the vulnerability as not automatable, consistent with a medium-severity issue that is not urgent in the absence of prior credential compromise.
Stored HTML injection in EspoCRM before 10.0.6 allows unauthenticated attackers to plant arbitrary markup through the public Lead Capture form, which is persisted in LeadCaptureLogRecord.data and rendered unescaped when an administrator later opens the log record in the admin UI; the practical impact is limited to content and interface spoofing because the application's Content Security Policy blocks JavaScript execution, preventing classic script-based XSS or session theft. Exploitation requires the Lead Capture public form to be enabled and externally reachable, and the payload stays inert until a privileged administrator views the affected entry, so there is no immediate attacker-controlled trigger. Vendor-released patch 10.0.6 is available, publicly available exploit code exists, and no active exploitation has been confirmed (CISA KEV). The independently assessed severity is low-to-moderate (CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), consistent with the limited integrity-only, interaction-gated impact.
Token generation in EspoCRM through 10.0.8 relies on PHP's non-cryptographic rand() function, producing roughly 31-bit identifiers for lead-capture opt-in links, event invitations, and campaign URLs. Remote unauthenticated attackers who can reach those public endpoints can guess or enumerate valid tokens, allowing them to confirm opt-ins, accept or decline event invitations on behalf of other contacts, and read event details. Publicly available exploit code exists (a vendor commit and a public write-up), but there is no evidence of confirmed active exploitation in the wild, and the CVSS 6.3 rating reflects high attack complexity and only low confidentiality/integrity impact.
Server-side request forgery in EspoCRM before 10.0.4 allows authenticated users to route outbound HTTP requests to internal network services by exploiting an incomplete IPv6 blocklist in the host-validation layer. The HostCheck::ipAddressIsNotInternal() function strips ::ffff: IPv4-mapped prefixes but ignores three IPv6 transition address families - NAT64 (64:ff9b::/96), 6to4 (2002::/16), and Teredo (2001:0000::/32) - enabling an attacker who controls a domain with crafted AAAA records to also defeat the CURLOPT_RESOLVE IP-pinning guard and reach private infrastructure. A publicly available exploit has been confirmed by VulnCheck; no CISA KEV listing has been observed at time of analysis.
EspoCRM's POST /api/v1/EmailTemplate/:id/prepare endpoint exposes an IDOR-class ACL bypass (CWE-639) allowing authenticated low-privileged users to exfiltrate all field values from arbitrary Contact, Lead, Account, or User records prior to version 9.3.5. By supplying a target entity's email address as an attacker-controlled lookup key, the endpoint resolves and returns the full record without enforcing read:own or read:team ACL restrictions. A publicly available proof-of-concept exists; no public exploit identified at time of analysis as confirmed actively exploited (CISA KEV listing absent), but the low attack complexity and public POC meaningfully elevate real-world risk.
Unauthorized note pinning in EspoCRM 9.3.x allows authenticated low-privileged users to pin arbitrary notes, bypassing edit permissions on the parent object. A 'write first, authorize later' flaw in the POST /api/v1/Note/{id}/pin endpoint silently persists the pinned status even when the server returns a 403 error. Exploit code is publicly available, but the vulnerability has a low EPSS score (0.04%) and has not been observed in active exploitation.
Stored cross-site scripting in EspoCRM 9.3.3 and below enables an authenticated attacker to execute arbitrary JavaScript in the browser session of any user who opens a crafted SVG attachment. The attack exploits EspoCRM's inline SVG serving behavior combined with a CSP misconfiguration that blocks inline scripts but permits same-origin external scripts - allowing a separately uploaded attacker-controlled JavaScript file (also hosted on the same EspoCRM origin) to be loaded and executed. A public exploit exists per the vendor's own GitHub security advisory; no CISA KEV listing has been identified at time of analysis.
Insecure Direct Object Reference in EspoCRM 9.3.3 and earlier allows any authenticated user holding Email:create and Import permissions to read arbitrary attachment records owned by other users via the POST /api/v1/Email/importEml endpoint. The attacker supplies a victim's fileId, which the endpoint accepted without ACL validation and passed directly to the import service - importing the victim's .eml contents into the attacker's mailbox while simultaneously deleting the original victim attachment record as a side effect. A public proof-of-concept is available via the vendor's GitHub security advisory; EPSS remains at 0.02% (5th percentile), consistent with SSVC's 'Automatable: no' designation and no confirmed active exploitation at time of analysis.
Server-Side Request Forgery in EspoCRM 9.3.3 and below allows authenticated attackers to bypass internal IP restrictions via a DNS rebinding race condition in the image attachment endpoint, enabling internal network reconnaissance. The root cause is a split-resolver design: host validation uses dns_get_record() while the actual HTTP fetch uses curl's independent gethostbyname() resolver - attacker-controlled DNS can return a public IP for validation and an internal IP for the actual request. A secondary bypass exists where empty DNS results cause validation to silently permit the host. No public exploit has been confirmed as actively exploited (not in CISA KEV), though a POC is publicly available and the vendor-confirmed fix shipped in 9.3.4.
Stored HTML injection in EspoCRM 9.3.3 and below allows any authenticated low-privilege user to embed arbitrary HTML into system-generated email notifications by crafting malicious content in stream activity post fields. Emails are delivered under the system's trusted SMTP identity, making injected content appear fully legitimate to recipients and enabling phishing, user tracking via image beacons, and UI manipulation - with the @mention feature enabling precise targeting of specific users. A public proof-of-concept exists per the GitHub advisory; no active exploitation has been confirmed in CISA KEV, and EPSS sits at 0.03% (8th percentile), indicating limited real-world exploitation activity at time of analysis.
Authenticated SSRF in EspoCRM 9.3.3 and below allows credential-holding users to bypass internal-host validation by supplying alternative IPv4 representations (e.g., octal-encoded loopback `0177.0.0.1`) to the `/api/v1/Attachment/fromImageUrl` endpoint, causing the server to fetch and store responses from loopback-bound internal services. A public exploit is confirmed on Exploit-DB (52583), though EPSS is very low (0.03%, 7th percentile) and CISA KEV status has not been assigned, indicating limited observed mass exploitation. Vendor-released patch version 9.3.4 is available and resolves the issue.
Authorization bypass in EspoCRM 5.8.5 lets an authenticated low-privilege user reuse or manipulate Basic-Authorization and Espo-Authorization tokens to authenticate as a different user, including administrators, and inherit their privileges. The flaw stems from the login path never binding an auth token to its owning user, so a token valid for one account is accepted for another when passwords collide, also defeating two-factor authentication. Publicly available exploit code exists (Exploit-DB 48376); EPSS is low at 0.35%, and the issue is not listed in CISA KEV.
EspoCRM versions before 9.1.9 permit an attacker holding Knowledge Base edit privileges to plant a stored SVG element with an embedded link in an article body, which redirects a clicking victim to an attacker-controlled page that fires a CSRF request at the api/v1/User endpoint. If the victim re-enters credentials on that page, the attacker gains a new account whose privileges are defined by the CSRF payload - potentially an administrative one. The chain is fully gated: it requires an authenticated insider with KB edit rights, mandatory victim interaction, credential re-entry, and the pre-9.1.9 absence of CSRF protection on api/v1/User; EPSS is low (0.14%) and publicly available exploit code exists but no CISA KEV confirmation of active exploitation.
EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. Rated medium severity (CVSS 4.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
EspoCRM is a free, open-source customer relationship management platform. Rated high severity (CVSS 7.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
EspoCRM is an Open Source Customer Relationship Management software. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. Public exploit code available.
EspoCRM is an Open Source Customer Relationship Management software. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
EspoCRM is an Open Source Customer Relationship Management software. Rated medium severity (CVSS 5.9), this vulnerability is no authentication required. Public exploit code available.
EspoCRM is an Open Source CRM (Customer Relationship Management) software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the extension deployment form, which could lead to arbitrary PHP code execution. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbitrary PHP code execution. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel (HTTP). Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file containing malicious JavaScript to. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
EspoCRM 6.1.6 and prior suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in EspoCRM before 5.6.9. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An issue was discovered in EspoCRM before 5.6.9. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An issue was discovered in EspoCRM before 5.6.9. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An issue was discovered in EspoCRM before 5.6.9. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An issue was discovered in EspoCRM before 5.6.9. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
EspoCRM 5.6.4 is vulnerable to user password hash enumeration. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in EspoCRM before 5.6.6. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An issue was discovered in EspoCRM before 5.6.6. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An issue was discovered in EspoCRM before 5.6.6. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored XSS exists in views/fields/wysiwyg.js in EspoCRM 5.3.6 via a /#Email/view saved draft message. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Reflected XSS exists in client/res/templates/global-search/name-field.tpl in EspoCRM 5.3.6 via /#Account in the search panel. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in EspoCRM before 2.6.0 allows remote attackers to inject arbitrary web script or HTML via the desc parameter in an errors action to install/index.php. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available.
install/index.php in EspoCRM before 2.6.0 allows remote attackers to re-install the application via a 1 value in the installProcess parameter. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary local files via a .. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site scripting (XSS) vulnerability in EspoCRM allows remote authenticated users to inject arbitrary web script or HTML via the Name field in a new account. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Boolean-based blind SQL injection in EspoCRM versions 8.1.0 through 9.3.7 allows an authenticated non-administrator to inject crafted expressions through the 'where' parameter of the GET entity streamAttachments endpoint, enabling extraction of arbitrary database contents - including active administrator session tokens - and subsequent full privilege escalation. The flaw requires a valid low-privilege session (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, 7.6) and is not exploitable anonymously. Public exploit code exists for this issue, though it has not been confirmed as actively exploited (CISA KEV); EspoCRM 9.3.8 is the fixed release.
PHP object deserialization in EspoCRM versions prior to 9.3.7 lets an authenticated administrator achieve remote code execution by storing crafted serialized object data in background MassAction or Export parameters that the application later unserializes without any allowed-class restriction. The deserialization sinks are reachable over the network (AV:N) with no user interaction (UI:N), and an attacker with admin credentials can instantiate arbitrary PHP objects and execute code, provided a usable gadget chain is reachable in the deployed codebase or its dependencies. Publicly available exploit code exists, and the vendor released a fix in version 9.3.7; the practical limiting factor is the administrator-privilege prerequisite (PR:H), which tempers real-world urgency even though the flaw is rated 9.1.
EspoCRM deployments before 10.0.5 allow an authenticated user with Email Account scope to retrieve other users' stored IMAP passwords via an insecure direct object reference in PersonalAccount\Service, enabling mailbox compromise. Attackers must know or enumerate a victim's Email Account record ID, and publicly available exploit code exists; there is no confirmation of active exploitation (CISA KEV) at time of analysis. The vulnerability is a confidentiality-only issue with changed scope, rated high risk because it exposes reusable credentials.
Path traversal in EspoCRM admin template management allows authenticated administrators to read, create, overwrite, or delete arbitrary files on the server filesystem. The vulnerability affects all versions prior to 9.3.4 and stems from unsanitized `name` and `scope` parameters in template path construction. Publicly available exploit code exists (GitHub security advisory GHSA-44c3-xjfp-3jrh), though no CISA KEV listing or confirmed active exploitation. CVSS 7.2 reflects high impact across confidentiality, integrity, and availability, but exploitation requires high-privilege (admin) access, significantly limiting real-world exposure to insider threats or compromised admin credentials.
Path traversal in EspoCRM's formula scripting engine allows authenticated administrators to achieve arbitrary file read/write on the web server by manipulating attachment sourceId fields. The vulnerability chains unsanitized user input with filesystem operations, enabling admins to overwrite or access files anywhere within PHP's open_basedir restriction. Publicly available exploit code exists. Vendor-released patch version 9.3.4 addresses this critical issue. Despite the 9.1 CVSS score and Changed scope indicating potential container escape or cross-tenant impact, EPSS data was not provided to assess real-world exploitation likelihood.
An authorization bypass (IDOR) in EspoCRM's PDF rendering pipeline lets an authenticated low-privilege user read attachments they should not be able to access by supplying an arbitrary attachment ID as the image source of a PDF template. Affected versions are EspoCRM up to 9.3.10 and 10.0.10; the flaw resides in ImageSourceProvider::get (application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php) and is reached simply by rendering a template to PDF. Impact is limited to confidentiality of attachment data (CVSS 5.3, PR:L, no victim interaction), publicly available exploit code exists, and there is no indication of active exploitation in the wild.
EspoCRM installations prior to 10.0.2 allow an authenticated user holding the mass-update permission to duplicate an existing Attachment record by supplying its identifier, because the mass-update processor copied the file without performing an ACL read check - the resulting copy is then readable by the attacker, disclosing the file's contents. Impact is confidentiality-only (no integrity or availability effect) and exploitation is constrained: the attacker must already possess an elevated mass-update privilege and must know a valid attachment ID for a file they are not authorized to read, which the vendor acknowledges is difficult to obtain. Publicly available exploitation material exists in the form of the upstream advisory, the fix commit that pinpoints the vulnerable code path (Tools/MassUpdate/Processor.php), and the 10.0.2 release notes; there is no CISA KEV listing indicating confirmed active exploitation of this issue.
EspoCRM versions prior to 10.0.3 can disclose restricted record and user fields to an authenticated user who holds both email-template edit access and mass-email sending access, because the template renderer stops applying per-user ACL filtering when messages are generated for mass email and for administrator-controlled group-email auto-replies. Only fields explicitly marked FORBIDDEN, INTERNAL, or ONLY_ADMIN are exposed, so the impact is limited to information disclosure with no code execution, data modification, or availability loss, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (6.5, authenticated remote). Publicly available exploit code exists for this issue, but the prerequisite privilege pairing is not part of a typical default non-administrative role, keeping real-world priority at medium rather than urgent.
An authenticated administrator on EspoCRM instances prior to 9.3.10 can abuse the administrative Label Manager to read, modify, create, or delete JSON files outside the intended language directory by supplying crafted 'scope' and 'language' parameters. Exploitation requires a full administrator session (CVSS PR:H) and is bounded by filesystem permissions and server configuration, which limits the reachable files to those the PHP/web-server process can access, making this mainly a privilege-abuse and defense-in-depth concern rather than a path to arbitrary file compromise. Publicly available exploit code exists (the vendor's advisory and a fix commit were published), but there is no CISA KEV entry confirming active exploitation; EPSS data was not provided, so exploit likelihood should be treated as elevated but not critical.
Stored HTML injection in EspoCRM versions prior to 9.3.9 lets an unauthenticated remote sender place arbitrary HTML into the plain-text body of an email sent to a monitored group, IMAP, or email-to-Case mailbox; EspoCRM stores that body and renders it without escaping inside 'Email Received' stream notification emails delivered to users following the related record, allowing HTML injection and, in mail clients that execute embedded markup, JavaScript execution. Exploitation is constrained by the inbound-mail prerequisite, by required victim interaction (the follower must open the notification email, CVSS vector UI:R), and by mail-client behavior, yielding a moderate CVSS 3.1 score of 4.3 with limited integrity impact and no confidentiality or availability impact. Publicly available exploit code and the upstream fix commit are both public, but no confirmed active exploitation has been reported at time of analysis.
EspoCRM versions prior to 9.3.9 fail to neutralize spreadsheet formula triggers in exported CSV and XLSX files, because sanitizeCellValue() only inspects the first byte of a cell value. An authenticated low-privileged user can store free-text content such as " =cmd|' /C calc'!A0" (whitespace or a control character before the trigger), so the leading single-quote neutralization prefix is never applied; a separate privileged user must then export the affected records, open the file, and accept the spreadsheet application's formula/security prompts before the cell is evaluated, enabling outbound data disclosure and, on legacy configurations with DDE enabled, command execution. Tracked as CWE-1236 with CVSS 3.1 base score 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), and publicly available exploit code exists; no confirmed active exploitation (CISA KEV) was identified. This is a moderate, conditional risk best treated as a medium-priority hygiene fix rather than an urgent emergency.
Stored cross-site scripting in EspoCRM versions prior to 9.3.9 allows an authenticated user holding Email Template or PDF Template edit permission to persist crafted HTML that evades the moderateSanitizeHtml() filtering routine. The payload only executes when a second user opens the tampered template in edit mode on an instance where the non-default setting clientCspDisabled is true, at which point the attacker can hijack the victim's session; default deployments keep Content-Security-Policy enabled and are not affected. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV) and the vendor has shipped a fix in 9.3.9, making this a genuine but low-priority, non-default-configuration-dependent issue.
Stored cross-site scripting in EspoCRM (all versions prior to 9.3.9) lets an authenticated administrator inject JavaScript that executes in every user's browser session by placing crafted content in the applicationName setting and abusing CSP nonce injection. The payload is persisted in the main application page without escaping, so it executes for all users who load the application and can leak page data including unsaved form input. Publicly available exploit code exists, but exploitation requires the highest application privilege (administrator), and impact is limited to confidentiality (C:L) with no integrity or availability effect, making this a genuinely low-priority issue despite the available POC.
Broken object-level authorization in EspoCRM before 9.3.7 allows any authenticated user who has been granted Import scope access to read the row-level error CSV of another user's import job by posting to /api/v1/Import/{id}/exportErrors with a foreign import identifier. The endpoint returns an attachment identifier for the error file, exposing imported data rows (customer records, contact data, and similar) that the caller does not own; the exposure is limited to the contents of that import's error export and requires the attacker to know or enumerate a target import ID. Publicly available exploit code exists (the upstream advisory, fix commit, and 9.3.7 release are publicly linked), but there is no confirmed active exploitation via CISA KEV and no EPSS score was supplied; the vendor-released patch is 9.3.7, which adds the missing entity-level read check.
Unauthorized integrity change in EspoCRM before 9.3.7 lets an authenticated, low-privileged user flip the opted_out state on Contacts or Leads they are not permitted to read or edit, by calling the TargetList opt-out or cancel-opt-out action with record identifiers they do not legitimately control. The attacker must already hold a valid account with access to a shared TargetList, and the resulting impact is confined to the opt-out relationship flag on the targeted records - there is no confidentiality or availability impact, consistent with the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) and score of 4.3. Publicly available exploit code exists, the issue is fixed in EspoCRM 9.3.7, and there is no confirmed active exploitation (not in CISA KEV).
Information disclosure in EspoCRM's portal Note API allows an authenticated portal user (CVSS PR:L) who already has stream access to a parent record to retrieve internal agent notes by directly requesting a single Note by its known identifier; the stream list endpoint correctly filters notes where isInternal is true, but the direct single-Note read path fails to apply that restriction. Only EspoCRM versions prior to 9.3.7 are affected, and the issue is resolved in 9.3.7. Publicly available exploit code exists, but the practical risk is moderated by the preconditions: a valid portal credential, stream access to the relevant parent record, and knowledge of the specific note identifier - there is no described bulk enumeration, so exposure is per-known-identifier rather than wholesale dumping of internal content. No public exploit identified at time of analysis is contradicted here - exploitation code is public, but this is not confirmed as actively exploited (no CISA KEV listing).
An access-control bypass in EspoCRM 4.0.0 through 10.0.6 lets any authenticated user who already holds Stream access to a parent record read historical 'was'/'became' values of fields protected by field-level security, by calling the REST endpoint GET /Note/{id} directly, which skips the NoteAccessControl filter. Impact is limited to confidentiality (CVSS 4.0 base 5.3, VC:L with VI:N/VA:N; independently assessed as CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and is meaningful only in deployments that actually use field-level security to hide audited fields from lower-privilege users. Publicly available exploit code exists (GitHub advisory GHSA-mr36-xx82-qf6h, VulnCheck advisory), while there is no evidence of active exploitation or CISA KEV listing at time of analysis.
EspoCRM versions 4.0.0 through 10.0.6 allow authenticated users to read email addresses that Role-based field-level restrictions are supposed to conceal, because the address-book search API does not enforce the emailAddress field permission. An attacker only needs a valid account with record access plus a deployment that relies on Roles to hide emailAddress from that user; environments that do not restrict the field have nothing to leak. Publicly available exploit code exists, though the impact is read-only disclosure and the issue has been assessed as a medium-severity, low-urgency information exposure (CVSS 5.3) with no indication of confirmed active exploitation in the wild.
Authenticated EspoCRM users holding Import scope access can read other users' file attachments by abusing an insecure direct object reference in the Import module, allowing disclosure of files they do not own. The flaw affects EspoCRM releases before 10.0.7 and is reachable over the network by any logged-in account that has been granted the administrative Import permission; anonymous users and accounts without Import scope cannot trigger it. Exploitation requires knowledge or guessing of a valid foreign attachmentId, after which the attacker creates an Import record referencing that ID and calls the error-export endpoint to copy the referenced rows into a CSV they control. Publicly available exploit code exists, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms a confidentiality-only, medium-severity impact with no integrity or availability effect; no public exploit identified as confirmed actively exploited (CISA KEV) status was reported in the source data.
An authentication bypass in EspoCRM versions before 10.0.6 allows an attacker who already possesses a valid username and password for a two-factor-enabled account to stop at the second-factor prompt and still reach routes that do not enforce full authentication, exposing configuration parameters that are not otherwise publicly available. The CVSS vector carries PR:L, confirming the attack presupposes previously obtained first-factor credentials, so it provides no initial access on its own and the demonstrated impact is read-only confidentiality loss with no write, code execution, or account takeover. Publicly available exploit code exists and the vendor has released EspoCRM 10.0.6 as the fix, while CISA's SSVC assessment rates exploitation as none and the vulnerability as not automatable, consistent with a medium-severity issue that is not urgent in the absence of prior credential compromise.
Stored HTML injection in EspoCRM before 10.0.6 allows unauthenticated attackers to plant arbitrary markup through the public Lead Capture form, which is persisted in LeadCaptureLogRecord.data and rendered unescaped when an administrator later opens the log record in the admin UI; the practical impact is limited to content and interface spoofing because the application's Content Security Policy blocks JavaScript execution, preventing classic script-based XSS or session theft. Exploitation requires the Lead Capture public form to be enabled and externally reachable, and the payload stays inert until a privileged administrator views the affected entry, so there is no immediate attacker-controlled trigger. Vendor-released patch 10.0.6 is available, publicly available exploit code exists, and no active exploitation has been confirmed (CISA KEV). The independently assessed severity is low-to-moderate (CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), consistent with the limited integrity-only, interaction-gated impact.
Token generation in EspoCRM through 10.0.8 relies on PHP's non-cryptographic rand() function, producing roughly 31-bit identifiers for lead-capture opt-in links, event invitations, and campaign URLs. Remote unauthenticated attackers who can reach those public endpoints can guess or enumerate valid tokens, allowing them to confirm opt-ins, accept or decline event invitations on behalf of other contacts, and read event details. Publicly available exploit code exists (a vendor commit and a public write-up), but there is no evidence of confirmed active exploitation in the wild, and the CVSS 6.3 rating reflects high attack complexity and only low confidentiality/integrity impact.
Server-side request forgery in EspoCRM before 10.0.4 allows authenticated users to route outbound HTTP requests to internal network services by exploiting an incomplete IPv6 blocklist in the host-validation layer. The HostCheck::ipAddressIsNotInternal() function strips ::ffff: IPv4-mapped prefixes but ignores three IPv6 transition address families - NAT64 (64:ff9b::/96), 6to4 (2002::/16), and Teredo (2001:0000::/32) - enabling an attacker who controls a domain with crafted AAAA records to also defeat the CURLOPT_RESOLVE IP-pinning guard and reach private infrastructure. A publicly available exploit has been confirmed by VulnCheck; no CISA KEV listing has been observed at time of analysis.
EspoCRM's POST /api/v1/EmailTemplate/:id/prepare endpoint exposes an IDOR-class ACL bypass (CWE-639) allowing authenticated low-privileged users to exfiltrate all field values from arbitrary Contact, Lead, Account, or User records prior to version 9.3.5. By supplying a target entity's email address as an attacker-controlled lookup key, the endpoint resolves and returns the full record without enforcing read:own or read:team ACL restrictions. A publicly available proof-of-concept exists; no public exploit identified at time of analysis as confirmed actively exploited (CISA KEV listing absent), but the low attack complexity and public POC meaningfully elevate real-world risk.
Unauthorized note pinning in EspoCRM 9.3.x allows authenticated low-privileged users to pin arbitrary notes, bypassing edit permissions on the parent object. A 'write first, authorize later' flaw in the POST /api/v1/Note/{id}/pin endpoint silently persists the pinned status even when the server returns a 403 error. Exploit code is publicly available, but the vulnerability has a low EPSS score (0.04%) and has not been observed in active exploitation.
Stored cross-site scripting in EspoCRM 9.3.3 and below enables an authenticated attacker to execute arbitrary JavaScript in the browser session of any user who opens a crafted SVG attachment. The attack exploits EspoCRM's inline SVG serving behavior combined with a CSP misconfiguration that blocks inline scripts but permits same-origin external scripts - allowing a separately uploaded attacker-controlled JavaScript file (also hosted on the same EspoCRM origin) to be loaded and executed. A public exploit exists per the vendor's own GitHub security advisory; no CISA KEV listing has been identified at time of analysis.
Insecure Direct Object Reference in EspoCRM 9.3.3 and earlier allows any authenticated user holding Email:create and Import permissions to read arbitrary attachment records owned by other users via the POST /api/v1/Email/importEml endpoint. The attacker supplies a victim's fileId, which the endpoint accepted without ACL validation and passed directly to the import service - importing the victim's .eml contents into the attacker's mailbox while simultaneously deleting the original victim attachment record as a side effect. A public proof-of-concept is available via the vendor's GitHub security advisory; EPSS remains at 0.02% (5th percentile), consistent with SSVC's 'Automatable: no' designation and no confirmed active exploitation at time of analysis.
Server-Side Request Forgery in EspoCRM 9.3.3 and below allows authenticated attackers to bypass internal IP restrictions via a DNS rebinding race condition in the image attachment endpoint, enabling internal network reconnaissance. The root cause is a split-resolver design: host validation uses dns_get_record() while the actual HTTP fetch uses curl's independent gethostbyname() resolver - attacker-controlled DNS can return a public IP for validation and an internal IP for the actual request. A secondary bypass exists where empty DNS results cause validation to silently permit the host. No public exploit has been confirmed as actively exploited (not in CISA KEV), though a POC is publicly available and the vendor-confirmed fix shipped in 9.3.4.
Stored HTML injection in EspoCRM 9.3.3 and below allows any authenticated low-privilege user to embed arbitrary HTML into system-generated email notifications by crafting malicious content in stream activity post fields. Emails are delivered under the system's trusted SMTP identity, making injected content appear fully legitimate to recipients and enabling phishing, user tracking via image beacons, and UI manipulation - with the @mention feature enabling precise targeting of specific users. A public proof-of-concept exists per the GitHub advisory; no active exploitation has been confirmed in CISA KEV, and EPSS sits at 0.03% (8th percentile), indicating limited real-world exploitation activity at time of analysis.
Authenticated SSRF in EspoCRM 9.3.3 and below allows credential-holding users to bypass internal-host validation by supplying alternative IPv4 representations (e.g., octal-encoded loopback `0177.0.0.1`) to the `/api/v1/Attachment/fromImageUrl` endpoint, causing the server to fetch and store responses from loopback-bound internal services. A public exploit is confirmed on Exploit-DB (52583), though EPSS is very low (0.03%, 7th percentile) and CISA KEV status has not been assigned, indicating limited observed mass exploitation. Vendor-released patch version 9.3.4 is available and resolves the issue.
Authorization bypass in EspoCRM 5.8.5 lets an authenticated low-privilege user reuse or manipulate Basic-Authorization and Espo-Authorization tokens to authenticate as a different user, including administrators, and inherit their privileges. The flaw stems from the login path never binding an auth token to its owning user, so a token valid for one account is accepted for another when passwords collide, also defeating two-factor authentication. Publicly available exploit code exists (Exploit-DB 48376); EPSS is low at 0.35%, and the issue is not listed in CISA KEV.
EspoCRM versions before 9.1.9 permit an attacker holding Knowledge Base edit privileges to plant a stored SVG element with an embedded link in an article body, which redirects a clicking victim to an attacker-controlled page that fires a CSRF request at the api/v1/User endpoint. If the victim re-enters credentials on that page, the attacker gains a new account whose privileges are defined by the CSRF payload - potentially an administrative one. The chain is fully gated: it requires an authenticated insider with KB edit rights, mandatory victim interaction, credential re-entry, and the pre-9.1.9 absence of CSRF protection on api/v1/User; EPSS is low (0.14%) and publicly available exploit code exists but no CISA KEV confirmation of active exploitation.
EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. Rated medium severity (CVSS 4.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
EspoCRM is a free, open-source customer relationship management platform. Rated high severity (CVSS 7.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
EspoCRM is an Open Source Customer Relationship Management software. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. Public exploit code available.
EspoCRM is an Open Source Customer Relationship Management software. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
EspoCRM is an Open Source Customer Relationship Management software. Rated medium severity (CVSS 5.9), this vulnerability is no authentication required. Public exploit code available.
EspoCRM is an Open Source CRM (Customer Relationship Management) software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the extension deployment form, which could lead to arbitrary PHP code execution. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbitrary PHP code execution. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel (HTTP). Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file containing malicious JavaScript to. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
EspoCRM 6.1.6 and prior suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in EspoCRM before 5.6.9. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An issue was discovered in EspoCRM before 5.6.9. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An issue was discovered in EspoCRM before 5.6.9. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An issue was discovered in EspoCRM before 5.6.9. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An issue was discovered in EspoCRM before 5.6.9. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
EspoCRM 5.6.4 is vulnerable to user password hash enumeration. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in EspoCRM before 5.6.6. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An issue was discovered in EspoCRM before 5.6.6. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An issue was discovered in EspoCRM before 5.6.6. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored XSS exists in views/fields/wysiwyg.js in EspoCRM 5.3.6 via a /#Email/view saved draft message. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Reflected XSS exists in client/res/templates/global-search/name-field.tpl in EspoCRM 5.3.6 via /#Account in the search panel. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in EspoCRM before 2.6.0 allows remote attackers to inject arbitrary web script or HTML via the desc parameter in an errors action to install/index.php. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available.
install/index.php in EspoCRM before 2.6.0 allows remote attackers to re-install the application via a 1 value in the installProcess parameter. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary local files via a .. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site scripting (XSS) vulnerability in EspoCRM allows remote authenticated users to inject arbitrary web script or HTML via the Name field in a new account. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.