Login Request a demo
ES
Vendor
espocrm
1 product with CVEs on record
65
CVEs
0
On KEV
19
New 30D
Products
ES
espocrm
espocrm
9.1
65 CVEs0 on KEV19 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-113643
ES
EspoCRM
Espocrm
4.3
0%
Oct 20EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization
CVE-2026-75505
ES
espocrm
espocrm
6.0
0%
Oct 15EspoCRM: Access control bypass in Mass Update letting regular user with Mass Update permission read any attachment
CVE-2026-77460
ES
espocrm
espocrm
6.5
0%
Oct 15EspoCRM: Mass email template renderer leaks restricted record fields
CVE-2026-63130
ES
espocrm
espocrm
5.5
0%
Oct 15EspoCRM: Admin path traversal in LabelManager (Custom Label saving) allows arbitrary `.json` file read, write and delete
CVE-2026-59994
ES
espocrm
espocrm
4.3
0%
Oct 15EspoCRM: Pre-authentication stored HTML injection in stream notification emails about email received
CVE-2026-55154
ES
espocrm
espocrm
5.4
0%
Oct 15EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export
CVE-2026-55184
ES
espocrm
espocrm
3.5
0%
Oct 15EspoCRM: Stored XSS in wysiwyg template fields if CSP is disabled
CVE-2026-53575
ES
espocrm
espocrm
2.7
0%
Oct 15EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user
CVE-2026-53574
ES
espocrm
espocrm
7.6
0%
Oct 15EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression
CVE-2026-46691
ES
espocrm
espocrm
6.5
0%
Oct 15EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users
CVE-2026-46708
ES
espocrm
espocrm
4.3
0%
Oct 15EspoCRM: Target list Opt-Out actions allows opting out record without access Target List and access to record
CVE-2026-47168
ES
espocrm
espocrm
9.1
0%
Oct 15EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params
CVE-2026-46694
ES
espocrm
espocrm
6.5
0%
Oct 15EspoCRM: Portal User ACL Bypass Exposes Internal Stream Notes
CVE-2026-109959
ES
espocrm
espocrm
4.3
0%
Oct 13EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint
CVE-2026-109958
ES
espocrm
espocrm
4.3
0%
Oct 13EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search
CVE-2026-109957
ES
espocrm
espocrm
4.3
0%
Oct 13EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter
CVE-2026-105833
ES
espocrm
espocrm
7.7
0%
Oct 8EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwords
CVE-2026-105832
ES
espocrm
espocrm
4.3
0%
Oct 8EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes
CVE-2026-105831
ES
espocrm
espocrm
4.3
0%
Oct 8EspoCRM before 10.0.6 Unauthenticated Stored HTML Injection via Lead Capture Form
CVE-2026-92298
ES
EspoCRM
EspoCRM
4.8
0%
Sep 16EspoCRM through 10.0.8 Weak Token Generation via rand()
CVE-2026-90934
ES
espocrm
espocrm
4.3
0%
Sep 14EspoCRM before 10.0.4 Field-level Security Bypass via Attendees
CVE-2026-88896
ES
espocrm
espocrm
5.3
0%
Sep 10EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass
CVE-2026-41141
ES
espocrm
espocrm
6.5
0%
May 28EspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity Data via Email Address Lookup
CVE-2026-41160
ES
espocrm
espocrm
4.3
0%
May 28EspoCRM: Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of notes
CVE-2026-33741
ES
espocrm
espocrm
6.8
0%
May 19EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript
CVE-2026-33733
ES
espocrm
espocrm
7.2
0%
Apr 22EspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and delete
CVE-2026-33656
ES
espocrm
espocrm
9.1
0%
Apr 22EspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment `sourceId`, exploitable by admin user
CVE-2026-33740
ES
espocrm
espocrm
5.4
0%
Apr 13EspoCRM: Email importEml can import and delete another user's attachment by raw fileId
CVE-2026-33659
ES
espocrm
espocrm
3.1
0%
Apr 13EspoCRM: SSRF via DNS Rebinding in Attachment fromImageUrl Endpoint Allows Internal Network Access
CVE-2026-33657
ES
espocrm
espocrm
5.4
0%
Apr 13EspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field
CVE-2026-33534
ES
espocrm
espocrm
4.3
2%
Apr 13EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation
CVE-2020-37094
ES
Espocrm
Espocrm
8.1
1%
Feb 3EspoCRM 5.7.0 prior to 5.9.0 contains an authentication token reuse vulnerability that allows authenticated attackers to bypass two-factor authentication by exploiting…
CVE-2025-59428
ES
Espocrm
Espocrm
5.4
0%
Oct 14EspoCRM is an open source customer relationship management application
CVE-2025-52892
ES
Espocrm
Espocrm
6.5
0%
Aug 5EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP
CVE-2025-52575
ES
Espocrm
Espocrm
6.5
1%
Jul 21EspoCRM is an Open Source CRM (Customer Relationship Management) software
CVE-2025-32390
ES
Espocrm
Espocrm
8.5
0%
May 12EspoCRM is a free, open-source customer relationship management platform
CVE-2025-32789
ES
Espocrm
Espocrm
3.7
0%
Apr 16EspoCRM is an Open Source Customer Relationship Management software
CVE-2025-32385
ES
Espocrm
Espocrm
6.5
0%
Apr 16EspoCRM is an Open Source Customer Relationship Management software
CVE-2024-24818
ES
Espocrm
Espocrm
5.9
1%
Mar 21EspoCRM is an Open Source Customer Relationship Management software
CVE-2023-46736
ES
Espocrm
Espocrm
6.5
0%
Dec 5EspoCRM is an Open Source CRM (Customer Relationship Management) software
CVE-2023-5966
ES
Espocrm
Espocrm
7.2
1%
Nov 30An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the extension deployment form, which could lead to arbitrary…
CVE-2023-5965
ES
Espocrm
Espocrm
7.2
1%
Nov 30An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbitrary PHP code…
CVE-2022-38846
ES
Espocrm
Espocrm
5.9
1%
Sep 16EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel (HTTP)
CVE-2022-38845
ES
Espocrm
Espocrm
6.1
1%
Sep 16Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file containing malicious…
CVE-2022-38844
ES
Espocrm
Espocrm
8.0
1%
Sep 16CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands
CVE-2022-38843
ES
Espocrm
Espocrm
8.8
1%
Sep 16EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server
CVE-2021-3539
ES
Espocrm
Espocrm
5.4
1%
Aug 4EspoCRM 6.1.6 and prior suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images
CVE-2019-14550
ES
Espocrm
Espocrm
5.4
1%
Aug 5An issue was discovered in EspoCRM before 5.6.9
CVE-2019-14549
ES
Espocrm
Espocrm
5.4
1%
Aug 5An issue was discovered in EspoCRM before 5.6.9
CVE-2019-14548
ES
Espocrm
Espocrm
5.4
1%
Aug 5An issue was discovered in EspoCRM before 5.6.9
CVE-2019-14547
ES
Espocrm
Espocrm
5.4
1%
Aug 5An issue was discovered in EspoCRM before 5.6.9
CVE-2019-14546
ES
Espocrm
Espocrm
5.4
1%
Aug 5An issue was discovered in EspoCRM before 5.6.9
CVE-2019-14351
ES
Espocrm
Espocrm
8.8
1%
Jul 28EspoCRM 5.6.4 is vulnerable to user password hash enumeration
CVE-2019-14350
ES
Espocrm
Espocrm
6.1
1%
Jul 28EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base
CVE-2019-14349
ES
Espocrm
Espocrm
6.1
1%
Jul 28EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab
CVE-2019-14331
ES
Espocrm
Espocrm
6.1
1%
Jul 28An issue was discovered in EspoCRM before 5.6.6
CVE-2019-14330
ES
Espocrm
Espocrm
6.1
1%
Jul 28An issue was discovered in EspoCRM before 5.6.6
CVE-2019-14329
ES
Espocrm
Espocrm
6.1
1%
Jul 28An issue was discovered in EspoCRM before 5.6.6
CVE-2019-13643
ES
Espocrm
Espocrm
6.1
1%
Jul 18Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages
CVE-2018-17302
ES
Espocrm
Espocrm
5.4
1%
Sep 21Stored XSS exists in views/fields/wysiwyg.js in EspoCRM 5.3.6 via a /#Email/view saved draft message