TI-2026-26112 CVE-2026-33733
EspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and delete
Priority HIGH 67
EspoCRM is an open source customer relationship management application.
Vulnerabilities
40 records
TI-2026-26036 CVE-2026-33656
Path traversal in espocrm
Priority HIGH 74
EspoCRM is an open source customer relationship management application.
TI-2026-26119 CVE-2026-33740
EspoCRM: Email importEml can import and delete another user's attachment by raw fileId
Priority MEDIUM 58
EspoCRM is an open source customer relationship management application.
TI-2026-26039 CVE-2026-33659
EspoCRM: SSRF via DNS Rebinding in Attachment fromImageUrl Endpoint Allows Internal Network Access
Priority MEDIUM 50
EspoCRM is an open source customer relationship management application.
TI-2026-26037 CVE-2026-33657
EspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field
Priority MEDIUM 58
EspoCRM is an open source customer relationship management application.
TI-2026-25927 CVE-2026-33534
EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation
Priority MEDIUM 53
EspoCRM is an open source customer relationship management application.
TI-2020-19229 CVE-2020-37094 · GHSA-wcm6-243c-86f3
EspoCRM 5.7.0 < 5.9.0 - Two-Factor Authentication Bypass via Auth Token Reuse Between Accounts with Identical Passwords
Priority HIGH 78
EspoCRM 5.7.0 prior to 5.9.0 contains an authentication token reuse vulnerability that allows authenticated attackers to bypass two-factor authentication by exploiting token-to-password-hash mapping in application/Espo/C…
TI-2025-36980 CVE-2025-59428
EspoCRM allows arbitrary user creation via stored SVG injection and CSRF
Priority MEDIUM 58
EspoCRM is an open source customer relationship management application.
TI-2025-32928 CVE-2025-52892
EspoCRM is vulnerable to access denial through double slash in URI corrupting router cache
Priority LOW 29
EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP.
TI-2025-32670 CVE-2025-52575
EspoCRM vulnerable to LDAP Injection through Improper Neutralization of Special Elements
Priority HIGH 68
EspoCRM is an Open Source CRM (Customer Relationship Management) software.
TI-2025-23468 CVE-2025-32390
EspoCRM vulnerable to HTML Injection into phishing, which may lead to account takeover
Priority HIGH 66
EspoCRM is a free, open-source customer relationship management platform.
TI-2025-23826 CVE-2025-32789
EspoCRM Allows Potential Disclosure of Sensitive Information in the User Sorting Function
Priority MEDIUM 51
EspoCRM is an Open Source Customer Relationship Management software.
Priority LOW 29
EspoCRM is an Open Source Customer Relationship Management software.
TI-2024-16335 CVE-2024-24818
EspoCRM weakness in "Forgot password"
Priority MEDIUM 60
EspoCRM is an Open Source Customer Relationship Management software.
TI-2023-25219 CVE-2023-46736
Server-Side Request Forgery in espocrm
Priority LOW 29
EspoCRM is an Open Source CRM (Customer Relationship Management) software.
TI-2023-05497 CVE-2023-5966 · GHSA-7wx4-fjq2-2hjg
Unrestricted Upload of File with Dangerous Type in EspoCRM
Priority LOW 36
An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the extension deployment form, which could lead to arbitrary PHP code execution.
TI-2023-05496 CVE-2023-5965 · GHSA-92xg-872w-r5g2
Unrestricted Upload of File with Dangerous Type in EspoCRM
Priority LOW 36
An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbitrary PHP code execution.
TI-2022-18314 CVE-2022-38843 · GHSA-9hh7-36j4-5fcg
EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to…
Priority MEDIUM 41
EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server.
TI-2022-18315 CVE-2022-38844 · GHSA-pvj2-28fw-3gc8
CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to…
Priority LOW 38
CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands.
TI-2022-18316 CVE-2022-38845 · GHSA-p6h4-8jrv-52x7
Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run…
Priority LOW 29
Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file containing malicious JavaScript to authenticated user.
TI-2022-18317 CVE-2022-38846 · GHSA-556p-rv4j-m787
EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send…
Priority LOW 27
EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel (HTTP).
TI-2021-02493 CVE-2021-3539 · GHSA-8v94-m4qx-qvc5
EspoCRM Avatar Persistent XSS
Priority LOW 29
EspoCRM 6.1.6 and prior suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images.
TI-2019-10839 CVE-2019-14547 · GHSA-wgp8-pjj7-7h3v
An issue was discovered in EspoCRM before 5.6.9.
Priority LOW 27
An issue was discovered in EspoCRM before 5.6.9.
TI-2019-10840 CVE-2019-14548 · GHSA-5v8g-2j3m-vrvv
An issue was discovered in EspoCRM before 5.6.9.
Priority LOW 27
An issue was discovered in EspoCRM before 5.6.9.
TI-2019-10838 CVE-2019-14546 · GHSA-r2ff-m48r-qqhj
An issue was discovered in EspoCRM before 5.6.9.
Priority LOW 27
An issue was discovered in EspoCRM before 5.6.9.