Espocrm Espocrm
43 CVEs affecting Espocrm Espocrm. Latest disclosed: 2026-05-28. Critical: 1, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-33656 | Critical | 9.1 | 2026-04-22 | EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formula scripting engine allowing updating a… |
CVE-2022-38843 | High | 8.8 | 2022-09-16 | EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server. Attacker may exec… |
CVE-2019-14351 | High | 8.8 | 2019-07-28 | EspoCRM 5.6.4 is vulnerable to user password hash enumeration. A malicious authenticated attacker can brute-force a user password hash by 1 symbol at a time us… |
CVE-2025-32390 | High | 8.5 | 2025-05-12 | EspoCRM is a free, open-source customer relationship management platform. Prior to version 9.0.8, HTML Injection in Knowledge Base (KB) articles leads to compl… |
CVE-2020-37094 | High | 8.1 | 2026-02-03 | EspoCRM 5.7.0 prior to 5.9.0 contains an authentication token reuse vulnerability that allows authenticated attackers to bypass two-factor authentication by ex… |
CVE-2022-38844 | High | 8.0 | 2022-09-16 | CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of execu… |
CVE-2026-33733 | High | 7.2 | 2026-04-22 | EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template management endpoints accept attacker-control… |
CVE-2026-33741 | Medium | 6.8 | 2026-05-19 | EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below allow authenticated users to upload SVG attachments through no… |
CVE-2026-41141 | Medium | 6.5 | 2026-05-28 | EspoCRM is an open source customer relationship management application. Prior to 9.3.5, the POST /api/v1/EmailTemplate/:id/prepare endpoint accepts an emailAdd… |
CVE-2025-52575 | Medium | 6.5 | 2025-07-21 | EspoCRM is an Open Source CRM (Customer Relationship Management) software. EspoCRM versions 9.1.6 and earlier are vulnerable to blind LDAP Injection when LDAP… |
CVE-2021-3539 | Medium | 6.3 | 2021-08-04 | EspoCRM 6.1.6 and prior suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. This issue was… |
CVE-2022-38845 | Medium | 6.1 | 2022-09-16 | Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file contai… |
CVE-2019-14350 | Medium | 6.1 | 2019-07-28 | EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base. A malicious attacker can inject JavaScript cod… |
CVE-2019-14349 | Medium | 6.1 | 2019-07-28 | EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in… |
CVE-2019-14331 | Medium | 6.1 | 2019-07-28 | An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create User. A malicious attacker can mod… |
CVE-2019-14330 | Medium | 6.1 | 2019-07-28 | An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create Case. A malicious attacker can mod… |
CVE-2019-14329 | Medium | 6.1 | 2019-07-28 | An issue was discovered in EspoCRM before 5.6.6. There is stored XSS due to lack of filtration of user-supplied data in Create Task. A malicious attacker can m… |
CVE-2019-13643 | Medium | 6.1 | 2019-07-18 | Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. The attack b… |
CVE-2024-24818 | Medium | 5.9 | 2024-03-21 | EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" page and redirect victi… |
CVE-2022-38846 | Medium | 5.9 | 2022-09-16 | EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel (HTTP). An attacker may cap… |