ES
Product
espocrm
65
CVEs
0
On KEV
9.1
Max CVSS
19
New 30D
Severity mix
Critical 2High 10Medium 45Low 4
Watch
Add espocrm to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-38843 | 8.8 | Sep 16 | EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server Affected: 7.1.8 |
| CVE-2019-14351 | 8.8 | Jul 28 | EspoCRM 5.6.4 is vulnerable to user password hash enumeration Affected: 5.6.4 |
| CVE-2025-32390 | 8.5 | May 12 | EspoCRM is a free, open-source customer relationship management platform Affected: before 9.0.8 |
| CVE-2020-37094 | 8.1 | Feb 3 | EspoCRM 5.7.0 < 5.9.0 - Two-Factor Authentication Bypass via Auth Token Reuse Between Accounts with Identical Passwords Affected: 5.7.0 before 5.9.0 |
| CVE-2022-38844 | 8.0 | Sep 16 | CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands Affected: 7.1.8 |
| CVE-2026-105833 | 7.7 | Oct 8 | EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwords Affected: before 10.0.5 |
| CVE-2026-53574 | 7.6 | Oct 15 | EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression Affected: >= 8.1.0, < 9.3.8 |
| CVE-2026-33733 | 7.2 | Apr 22 | EspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and delete Affected: < 9.3.4 |
| CVE-2023-5966 | 7.2 | Nov 30 | An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the extension deployment form, which could lead to arbitrary… Affected: through 7.5.2 |
| CVE-2023-5965 | 7.2 | Nov 30 | An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbitrary PHP code… Affected: through 7.5.2 |
Showing 10