Priority HIGH 78
EspoCRM 5.7.0 prior to 5.9.0 contains an authentication token reuse vulnerability that allows authenticated attackers to bypass two-factor authentication by exploiting token-to-password-hash mapping in application/Espo/C…
CVSS 4.0HIGH 8.6· Network · Low privileges · No interaction · EPSS 0.00525 · Published 2026-02-03 · Fixed in 5.9.0 CWE-303
Priority HIGH 74
EspoCRM is an open source customer relationship management application.
CVSS 3.1CRITICAL 9.1· Network · High privileges · No interaction · EPSS 0.005 · Published 2026-04-22 · Fixed in 9.3.4 CWE-22
Priority HIGH 68
EspoCRM is an Open Source CRM (Customer Relationship Management) software.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00776 · Published 2025-07-21 · Fixed in 9.1.7 CWE-90
Priority HIGH 67
EspoCRM is an open source customer relationship management application.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00448 · Published 2026-04-22 · Fixed in 9.3.4 CWE-23
Priority HIGH 66
EspoCRM is a free, open-source customer relationship management platform.
CVSS 4.0HIGH 7.0· Network · Low privileges · User interaction · EPSS 0.00382 · Published 2025-05-12 · Fixed in 9.0.8 CWE-74
Priority MEDIUM 60
EspoCRM is an Open Source Customer Relationship Management software.
CVSS 3.1MEDIUM 5.9· Adjacent network · No auth · User interaction · EPSS 0.00615 · Published 2024-02-29 · Fixed in 8.1.2 CWE-610
Priority MEDIUM 58
EspoCRM is an open source customer relationship management application.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00211 · Published 2026-04-13 · Fixed in 9.3.4 CWE-639
Priority MEDIUM 58
EspoCRM is an open source customer relationship management application.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00176 · Published 2026-04-13 · Fixed in 9.3.4 CWE-116
Priority MEDIUM 58
EspoCRM is an open source customer relationship management application.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00145 · Published 2025-10-14 · Fixed in 9.1.9 CWE-352
Priority MEDIUM 53
EspoCRM is an open source customer relationship management application.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.01978 · Published 2026-04-13 · Fixed in 9.3.4 CWE-918
Priority MEDIUM 51
EspoCRM is an Open Source Customer Relationship Management software.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.00428 · Published 2025-04-16 · Fixed in 9.0.7 CWE-200
Priority MEDIUM 51
Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary local files via a ..
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.05026 · Published 2014-10-31 · No fix listed CWE-22
Priority MEDIUM 50
EspoCRM is an open source customer relationship management application.
CVSS 3.1LOW 3.5· Network · Low privileges · No interaction · EPSS 0.00333 · Published 2026-04-13 · Fixed in 9.3.4 CWE-367
Priority MEDIUM 41
EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01348 · Published 2022-09-16 · No fix listed CWE-434
Priority MEDIUM 41
EspoCRM 5.6.4 is vulnerable to user password hash enumeration.
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01263 · Published 2019-07-28 · No fix listed CWE-307
Priority LOW 38
CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands.
CVSS 3.1HIGH 8.0· Network · Low privileges · User interaction · EPSS 0.01369 · Published 2022-09-16 · No fix listed CWE-1236
Priority LOW 36
An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the extension deployment form, which could lead to arbitrary PHP code execution.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.0104 · Published 2023-11-30 · No fix listed CWE-434
Priority LOW 36
An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbitrary PHP code execution.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.0104 · Published 2023-11-30 · No fix listed CWE-434
Priority LOW 30
An issue was discovered in EspoCRM before 5.6.6.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01327 · Published 2019-07-28 · No fix listed CWE-79
Priority LOW 30
An issue was discovered in EspoCRM before 5.6.6.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01327 · Published 2019-07-28 · No fix listed CWE-79
Priority LOW 30
An issue was discovered in EspoCRM before 5.6.6.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01327 · Published 2019-07-28 · No fix listed CWE-79
Priority LOW 30
Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0114 · Published 2019-07-18 · No fix listed CWE-79
Priority LOW 29
EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00283 · Published 2025-08-05 · Fixed in 9.1.7 CWE-444
Priority LOW 29
EspoCRM is an Open Source Customer Relationship Management software.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00309 · Published 2025-04-15 · Fixed in 9.0.5 CWE-1021
Priority LOW 29
EspoCRM is an Open Source CRM (Customer Relationship Management) software.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00355 · Published 2023-12-05 · Fixed in 8.0.5 CWE-918
Load more
THREATIST.IORead the docs