Espocrm vulnerabilities

Products

• Espocrm 66

Newest

• espocrm EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex CVE-2026-118686 8.7 HighOctober 28, 2026
• espocrm EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization CVE-2026-113643 5.3 MediumOctober 20, 2026
• espocrm EspoCRM: Access control bypass in Mass Update letting regular user with Mass Update permission read any attachment CVE-2026-75505 6.0 MediumOctober 15, 2026
• espocrm EspoCRM: Mass email template renderer leaks restricted record fields CVE-2026-77460 6.5 MediumOctober 15, 2026
• espocrm EspoCRM: Admin path traversal in LabelManager (Custom Label saving) allows arbitrary `.json` file read, write and delete CVE-2026-63130 5.5 MediumOctober 15, 2026
• espocrm EspoCRM: Pre-authentication stored HTML injection in stream notification emails about email received CVE-2026-59994 4.3 MediumOctober 15, 2026
• espocrm EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export CVE-2026-55154 5.4 MediumOctober 15, 2026
• espocrm EspoCRM: Stored XSS in wysiwyg template fields if CSP is disabled CVE-2026-55184 3.5 LowOctober 15, 2026
• espocrm EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user CVE-2026-53575 2.7 LowOctober 15, 2026
• espocrm EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression CVE-2026-53574 7.6 HighOctober 15, 2026
• espocrm EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users CVE-2026-46691 6.5 MediumOctober 15, 2026
• espocrm EspoCRM: Target list Opt-Out actions allows opting out record without access Target List and access to record CVE-2026-46708 4.3 MediumOctober 15, 2026
• espocrm EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params CVE-2026-47168 9.1 CriticalOctober 15, 2026
• espocrm EspoCRM: Portal User ACL Bypass Exposes Internal Stream Notes CVE-2026-46694 6.5 MediumOctober 15, 2026
• espocrm EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint CVE-2026-109959 5.3 MediumOctober 13, 2026
• espocrm EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search CVE-2026-109958 5.3 MediumOctober 13, 2026
• espocrm EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter CVE-2026-109957 5.3 MediumOctober 13, 2026
• espocrm EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwords CVE-2026-105833 8.3 HighOctober 8, 2026
• espocrm EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes CVE-2026-105832 5.3 MediumOctober 8, 2026
• espocrm EspoCRM before 10.0.6 Unauthenticated Stored HTML Injection via Lead Capture Form CVE-2026-105831 5.3 MediumOctober 8, 2026
• espocrm EspoCRM through 10.0.8 Weak Token Generation via rand() CVE-2026-92298 6.3 MediumSeptember 16, 2026
• espocrm EspoCRM before 10.0.4 Field-level Security Bypass via Attendees CVE-2026-90934 8.7 HighSeptember 14, 2026
• espocrm EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass CVE-2026-88896 6.9 MediumSeptember 10, 2026
• espocrm EspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity Data via Email Address Lookup CVE-2026-41141 6.5 MediumMay 28, 2026
• espocrm EspoCRM: Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of notes CVE-2026-41160 4.3 MediumMay 28, 2026
• espocrm EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript CVE-2026-33741 6.8 MediumMay 19, 2026
• espocrm EspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and delete CVE-2026-33733 7.2 HighApril 22, 2026
• espocrm EspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment `sourceId`, exploitable by admin user CVE-2026-33656 Public exploit 9.1 CriticalApril 22, 2026
• espocrm EspoCRM: Email importEml can import and delete another user's attachment by raw fileId CVE-2026-33740 5.4 MediumApril 13, 2026
• espocrm EspoCRM: SSRF via DNS Rebinding in Attachment fromImageUrl Endpoint Allows Internal Network Access CVE-2026-33659 3.5 LowApril 13, 2026
• espocrm EspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field CVE-2026-33657 Public exploit 4.6 MediumApril 13, 2026
• espocrm EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation CVE-2026-33534 Public exploit 4.3 MediumApril 13, 2026
• espocrm EspoCRM 5.7.0 < 5.9.0 - Two-Factor Authentication Bypass via Auth Token Reuse Between Accounts with Identical Passwords CVE-2020-37094 8.6 HighFebruary 3, 2026
• espocrm EspoCRM allows arbitrary user creation via stored SVG injection and CSRF CVE-2025-59428 5.4 MediumOctober 14, 2025
• espocrm EspoCRM is vulnerable to access denial through double slash in URI corrupting router cache CVE-2025-52892 4.5 MediumAugust 5, 2025
• espocrm EspoCRM vulnerable to LDAP Injection through Improper Neutralization of Special Elements CVE-2025-52575 6.5 MediumJuly 21, 2025
• espocrm EspoCRM vulnerable to HTML Injection into phishing, which may lead to account takeover CVE-2025-32390 7.0 HighMay 12, 2025
• espocrm EspoCRM Allows Potential Disclosure of Sensitive Information in the User Sorting Function CVE-2025-32789 3.1 LowApril 16, 2025
• espocrm EspoCRM allows unrestricted Embedding in Iframe dashlet CVE-2025-32385 5.3 MediumApril 15, 2025
• espocrm EspoCRM weakness in "Forgot password" CVE-2024-24818 Fix available 5.9 MediumFebruary 29, 2024
• espocrm Server-Side Request Forgery in espocrm CVE-2023-46736 Fix available 5.3 MediumDecember 5, 2023
• espocrm Unrestricted Upload of File with Dangerous Type in EspoCRM CVE-2023-5966 Public exploitFix available 4.7 MediumNovember 30, 2023
• espocrm Unrestricted Upload of File with Dangerous Type in EspoCRM CVE-2023-5965 Public exploitFix available 4.7 MediumNovember 30, 2023
• espocrm EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload... CVE-2022-38843 8.8 HighSeptember 16, 2022
• espocrm CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system... CVE-2022-38844 8.0 HighSeptember 16, 2022
• espocrm Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious... CVE-2022-38845 6.1 MediumSeptember 16, 2022
• espocrm EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain... CVE-2022-38846 5.9 MediumSeptember 16, 2022
• espocrm EspoCRM Avatar Persistent XSS CVE-2021-3539 Fix available 6.3 MediumAugust 4, 2021
• espocrm An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a attacker sends an... CVE-2019-14547 5.4 MediumAugust 5, 2019
• espocrm An issue was discovered in EspoCRM before 5.6.9. Stored XSS in the body of an Article was... CVE-2019-14548 5.4 MediumAugust 5, 2019
• Show olderLoading…