CVE-2026-41160 | Medium | 4.3 | 2026-05-28 | EspoCRM is an open source customer relationship management application. Prior to 9.3.5, a business logic flaw (Broken Access Control) in EspoCRM 9.3.3 allows l… |
CVE-2026-41141 | Medium | 6.5 | 2026-05-28 | EspoCRM is an open source customer relationship management application. Prior to 9.3.5, the POST /api/v1/EmailTemplate/:id/prepare endpoint accepts an emailAdd… |
CVE-2026-33741 | Medium | 6.8 | 2026-05-19 | EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below allow authenticated users to upload SVG attachments through no… |
CVE-2026-33733 | High | 7.2 | 2026-04-22 | EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template management endpoints accept attacker-control… |
CVE-2026-33656 | Critical | 9.1 | 2026-04-22 | EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formula scripting engine allowing updating a… |
CVE-2026-33740 | Medium | 5.4 | 2026-04-13 | EspoCRM is an open source customer relationship management application. In versions 9.3.3 and below, the POST /api/v1/Email/importEml endpoint contains an Inse… |
CVE-2026-33659 | Low | 3.5 | 2026-04-13 | EspoCRM is an open source customer relationship management application. In versions 9.3.3 and below, the POST /api/v1/Attachment/fromImageUrl endpoint is vulne… |
CVE-2026-33657 | Medium | 4.6 | 2026-04-13 | EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have a stored HTML injection vulnerability that allows any aut… |
CVE-2026-33534 | Medium | 4.3 | 2026-04-13 | EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have an authenticated Server-Side Request Forgery (SSRF) vulne… |
CVE-2020-37094 | High | 8.1 | 2026-02-03 | EspoCRM 5.7.0 prior to 5.9.0 contains an authentication token reuse vulnerability that allows authenticated attackers to bypass two-factor authentication by ex… |
CVE-2025-59428 | Medium | 5.4 | 2025-10-14 | EspoCRM is an open source customer relationship management application. In versions before 9.1.9, a vulnerability allows arbitrary user creation, including adm… |
CVE-2025-52892 | Medium | 4.5 | 2025-08-05 | EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. In versions 9.1.6 and below, if a use… |
CVE-2025-52575 | Medium | 6.5 | 2025-07-21 | EspoCRM is an Open Source CRM (Customer Relationship Management) software. EspoCRM versions 9.1.6 and earlier are vulnerable to blind LDAP Injection when LDAP… |
CVE-2025-32390 | High | 8.5 | 2025-05-12 | EspoCRM is a free, open-source customer relationship management platform. Prior to version 9.0.8, HTML Injection in Knowledge Base (KB) articles leads to compl… |
CVE-2025-32789 | Low | 3.1 | 2025-04-16 | EspoCRM is an Open Source Customer Relationship Management software. Prior to version 9.0.7, users can be sorted by their password hash. This flaw allows an at… |
CVE-2025-32385 | Medium | 5.3 | 2025-04-16 | EspoCRM is an Open Source Customer Relationship Management software. Prior to 9.0.5, Iframe dashlet allows user to display iframes with arbitrary URLs. As the… |
CVE-2024-24818 | Medium | 5.9 | 2024-03-21 | EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" page and redirect victi… |
CVE-2023-46736 | Medium | 5.3 | 2023-12-05 | EspoCRM is an Open Source CRM (Customer Relationship Management) software. In affected versions there is Server-Side Request Forgery (SSRF) vulnerability via t… |
CVE-2023-5966 | Medium | 4.7 | 2023-11-30 | An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the extension deployment form, which coul… |
CVE-2023-5965 | Medium | 4.7 | 2023-11-30 | An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbi… |
CVE-2022-38846 | Medium | 5.9 | 2022-09-16 | EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel (HTTP). An attacker may cap… |
CVE-2022-38845 | Medium | 6.1 | 2022-09-16 | Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file contai… |
CVE-2022-38844 | High | 8.0 | 2022-09-16 | CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of execu… |
CVE-2022-38843 | High | 8.8 | 2022-09-16 | EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server. Attacker may exec… |
CVE-2021-3539 | Medium | 6.3 | 2021-08-04 | EspoCRM 6.1.6 and prior suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. This issue was… |
CVE-2019-14550 | Medium | 5.4 | 2019-08-05 | An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a victim clicks on the Edit Dashboard feature present on the Homepage. An attacke… |
CVE-2019-14549 | Medium | 5.4 | 2019-08-05 | An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed inside the title and breadcrumb of a newly formed entity available to all the users. A… |
CVE-2019-14548 | Medium | 5.4 | 2019-08-05 | An issue was discovered in EspoCRM before 5.6.9. Stored XSS in the body of an Article was executed when a victim opens articles received through mail. This Art… |
CVE-2019-14547 | Medium | 5.4 | 2019-08-05 | An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a attacker sends an attachment to admin with malicious JavaScript in the filename… |
CVE-2019-14546 | Medium | 5.4 | 2019-08-05 | An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed on the Preference page as well as while sending an email when a malicious payload was… |
CVE-2019-14351 | High | 8.8 | 2019-07-28 | EspoCRM 5.6.4 is vulnerable to user password hash enumeration. A malicious authenticated attacker can brute-force a user password hash by 1 symbol at a time us… |
CVE-2019-14350 | Medium | 6.1 | 2019-07-28 | EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base. A malicious attacker can inject JavaScript cod… |
CVE-2019-14349 | Medium | 6.1 | 2019-07-28 | EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in… |
CVE-2019-14331 | Medium | 6.1 | 2019-07-28 | An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create User. A malicious attacker can mod… |
CVE-2019-14330 | Medium | 6.1 | 2019-07-28 | An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create Case. A malicious attacker can mod… |
CVE-2019-14329 | Medium | 6.1 | 2019-07-28 | An issue was discovered in EspoCRM before 5.6.6. There is stored XSS due to lack of filtration of user-supplied data in Create Task. A malicious attacker can m… |
CVE-2019-13643 | Medium | 6.1 | 2019-07-18 | Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. The attack b… |
CVE-2018-17302 | Medium | 5.4 | 2018-09-21 | Stored XSS exists in views/fields/wysiwyg.js in EspoCRM 5.3.6 via a /#Email/view saved draft message. |
CVE-2018-17301 | Medium | 5.4 | 2018-09-21 | Reflected XSS exists in client/res/templates/global-search/name-field.tpl in EspoCRM 5.3.6 via /#Account in the search panel. |
CVE-2014-7987 | | | 2014-10-31 | Cross-site scripting (XSS) vulnerability in EspoCRM before 2.6.0 allows remote attackers to inject arbitrary web script or HTML via the desc parameter in an er… |
CVE-2014-7986 | | | 2014-10-31 | install/index.php in EspoCRM before 2.6.0 allows remote attackers to re-install the application via a 1 value in the installProcess parameter. |
CVE-2014-7985 | | | 2014-10-31 | Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action… |
CVE-2014-8330 | | | 2014-10-20 | Cross-site scripting (XSS) vulnerability in EspoCRM allows remote authenticated users to inject arbitrary web script or HTML via the Name field in a new accoun… |