Espocrm - vulnerabilities (CVEs)

66 CVEs in 1 products, 20 in the last 30 days, newest from 2026-10-28.

Products

Espocrm - 51 CVEs

Newest CVEs of Espocrm

CVE-2026-118686 - CVSS 8.7 (high), 2026-10-28: EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API…
CVE-2026-113643 - CVSS 5.3 (medium), 2026-10-20: A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file…
CVE-2026-75505 - CVSS 6 (medium), 2026-10-15: EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known…
CVE-2026-77460 - CVSS 6.5 (medium), 2026-10-15: EspoCRM is an open source customer relationship management application. Prior to 10.0.3, a user with email-template edit access and mass-email sending access…
CVE-2026-63130 - CVSS 5.5 (medium), 2026-10-15: EspoCRM is an open source customer relationship management application. Prior to 9.3.10, an authenticated administrator can provide crafted input to the…
CVE-2026-59994 - CVSS 4.3 (medium), 2026-10-15: EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an unauthenticated remote attacker can send an email to a monitored…
CVE-2026-55154 - CVSS 5.4 (medium), 2026-10-15: EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Format/Csv/Processor.php,…
CVE-2026-55184 - CVSS 3.5 (low), 2026-10-15: EspoCRM is an open source customer relationship management application. Prior to 9.3.9, a user with Email Template or PDF Template edit permission can store…
CVE-2026-53575 - CVSS 2.7 (low), 2026-10-15: EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authenticated administrator can place crafted content in the…
CVE-2026-53574 - CVSS 7.6 (high), 2026-10-15: EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where…
CVE-2026-46691 - CVSS 6.5 (medium), 2026-10-15: EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST…
CVE-2026-46708 - CVSS 4.3 (medium), 2026-10-15: EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetList can invoke…
CVE-2026-47168 - CVSS 9.1 (critical), 2026-10-15: EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP…
CVE-2026-46694 - CVSS 6.5 (medium), 2026-10-15: EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a portal user with stream access to a parent record can directly fetch…
CVE-2026-109959 - CVSS 5.3 (medium), 2026-10-13: EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level…
CVE-2026-109958 - CVSS 5.3 (medium), 2026-10-13: EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the…
CVE-2026-109957 - CVSS 5.3 (medium), 2026-10-13: EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to read other users'…
CVE-2026-105832 - CVSS 5.3 (medium), 2026-10-08: EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring…
CVE-2026-105833 - CVSS 8.3 (high), 2026-10-08: EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access…
CVE-2026-105831 - CVSS 5.3 (medium), 2026-10-08: EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture…
CVE-2026-92298 - CVSS 6.3 (medium), 2026-09-16: EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a…
CVE-2026-90934 - CVSS 8.7 (high), 2026-09-14: EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read…
CVE-2026-88896 - CVSS 6.9 (medium), 2026-09-10: EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal(), which validates outbound URLs to block requests to…
CVE-2026-41160 - CVSS 4.3 (medium), 2026-05-28: EspoCRM is an open source customer relationship management application. Prior to 9.3.5, a business logic flaw (Broken Access Control) in EspoCRM 9.3.3 allows…
CVE-2026-41141 - CVSS 6.5 (medium), 2026-05-28: EspoCRM is an open source customer relationship management application. Prior to 9.3.5, the POST /api/v1/EmailTemplate/:id/prepare endpoint accepts an…
CVE-2026-33741 - CVSS 6.8 (medium), 2026-05-19: EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below allow authenticated users to upload SVG attachments through…
CVE-2026-33733 - CVSS 7.2 (high), 2026-04-22: EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template management endpoints accept…
CVE-2026-33656 - CVSS 9.1 (critical), 2026-04-22: EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formula scripting engine allowing updating…
CVE-2026-33740 - CVSS 5.4 (medium), 2026-04-13: EspoCRM is an open source customer relationship management application. In versions 9.3.3 and below, the POST /api/v1/Email/importEml endpoint contains an…
CVE-2026-33659 - CVSS 3.5 (low), 2026-04-13: EspoCRM is an open source customer relationship management application. In versions 9.3.3 and below, the POST /api/v1/Attachment/fromImageUrl endpoint is…