EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search

EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter

EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes

EspoCRM before 10.0.6 Unauthenticated Stored HTML Injection via Lead Capture Form

EspoCRM before 10.0.4 Field-level Security Bypass via Attendees

EspoCRM: Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of notes

EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation

EspoCRM is an Open Source Customer Relationship Management software

EspoCRM: Stored XSS in wysiwyg template fields if CSP is disabled

EspoCRM: SSRF via DNS Rebinding in Attachment fromImageUrl Endpoint Allows Internal Network Access

EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user

Cross-site scripting (XSS) vulnerability in EspoCRM before 2.6.0 allows remote attackers to inject arbitrary web script or HTML via the desc parameter in an errors action to…

install/index.php in EspoCRM before 2.6.0 allows remote attackers to re-install the application via a 1 value in the installProcess parameter

Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary local files via a

Cross-site scripting (XSS) vulnerability in EspoCRM allows remote authenticated users to inject arbitrary web script or HTML via the Name field in a new account