EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript

EspoCRM: Mass email template renderer leaks restricted record fields

EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users

EspoCRM: Portal User ACL Bypass Exposes Internal Stream Notes

EspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity Data via Email Address Lookup

EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP

EspoCRM is an Open Source CRM (Customer Relationship Management) software

EspoCRM is an Open Source Customer Relationship Management software

EspoCRM is an Open Source CRM (Customer Relationship Management) software

Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file containing malicious…

EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base

EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab

An issue was discovered in EspoCRM before 5.6.6

An issue was discovered in EspoCRM before 5.6.6

An issue was discovered in EspoCRM before 5.6.6

Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages

EspoCRM: Access control bypass in Mass Update letting regular user with Mass Update permission read any attachment

EspoCRM is an Open Source Customer Relationship Management software

EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel (HTTP)

EspoCRM: Admin path traversal in LabelManager (Custom Label saving) allows arbitrary `.json` file read, write and delete

EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export

EspoCRM: Email importEml can import and delete another user's attachment by raw fileId

EspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field

EspoCRM is an open source customer relationship management application

EspoCRM 6.1.6 and prior suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images

An issue was discovered in EspoCRM before 5.6.9

An issue was discovered in EspoCRM before 5.6.9

An issue was discovered in EspoCRM before 5.6.9

An issue was discovered in EspoCRM before 5.6.9

An issue was discovered in EspoCRM before 5.6.9

Stored XSS exists in views/fields/wysiwyg.js in EspoCRM 5.3.6 via a /#Email/view saved draft message

Reflected XSS exists in client/res/templates/global-search/name-field.tpl in EspoCRM 5.3.6 via /#Account in the search panel

EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass

EspoCRM through 10.0.8 Weak Token Generation via rand()

EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization

EspoCRM: Pre-authentication stored HTML injection in stream notification emails about email received

EspoCRM: Target list Opt-Out actions allows opting out record without access Target List and access to record

EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint

EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search

EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter

EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes

EspoCRM before 10.0.6 Unauthenticated Stored HTML Injection via Lead Capture Form

EspoCRM before 10.0.4 Field-level Security Bypass via Attendees

EspoCRM: Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of notes

EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation