EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params

EspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment `sourceId`, exploitable by admin user

EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server

EspoCRM 5.6.4 is vulnerable to user password hash enumeration

EspoCRM is a free, open-source customer relationship management platform

EspoCRM 5.7.0 prior to 5.9.0 contains an authentication token reuse vulnerability that allows authenticated attackers to bypass two-factor authentication by exploiting…

CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands

EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwords

EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression

EspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and delete

An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the extension deployment form, which could lead to arbitrary…

An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbitrary PHP code…

EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript

EspoCRM: Mass email template renderer leaks restricted record fields

EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users

EspoCRM: Portal User ACL Bypass Exposes Internal Stream Notes

EspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity Data via Email Address Lookup

EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP

EspoCRM is an Open Source CRM (Customer Relationship Management) software

EspoCRM is an Open Source Customer Relationship Management software

EspoCRM is an Open Source CRM (Customer Relationship Management) software

Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file containing malicious…

EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base

EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab

An issue was discovered in EspoCRM before 5.6.6

An issue was discovered in EspoCRM before 5.6.6

An issue was discovered in EspoCRM before 5.6.6

Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages

EspoCRM: Access control bypass in Mass Update letting regular user with Mass Update permission read any attachment

EspoCRM is an Open Source Customer Relationship Management software

EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel (HTTP)

EspoCRM: Admin path traversal in LabelManager (Custom Label saving) allows arbitrary `.json` file read, write and delete

EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export

EspoCRM: Email importEml can import and delete another user's attachment by raw fileId

EspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field

EspoCRM is an open source customer relationship management application

EspoCRM 6.1.6 and prior suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images

An issue was discovered in EspoCRM before 5.6.9

An issue was discovered in EspoCRM before 5.6.9

An issue was discovered in EspoCRM before 5.6.9

An issue was discovered in EspoCRM before 5.6.9

An issue was discovered in EspoCRM before 5.6.9

Stored XSS exists in views/fields/wysiwyg.js in EspoCRM 5.3.6 via a /#Email/view saved draft message

Reflected XSS exists in client/res/templates/global-search/name-field.tpl in EspoCRM 5.3.6 via /#Account in the search panel

EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass

EspoCRM through 10.0.8 Weak Token Generation via rand()

EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization

EspoCRM: Pre-authentication stored HTML injection in stream notification emails about email received

EspoCRM: Target list Opt-Out actions allows opting out record without access Target List and access to record

EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint