Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: espocrm 10.0.6 Clear all filters
TI-2026-69537 CVE-2026-105832 · GHSA-9h5f-ghfx-jfjc

Two-factor authentication bypass in EspoCRM on unauthenticated routes

Priority LOW 24

EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00266 Published 2026-10-08 Fixed in 10.0.6 CWE-287
TI-2026-69536 CVE-2026-105831 · GHSA-qv95-q49f-g838

Stored HTML injection in EspoCRM Lead Capture log records

Priority LOW 24

EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form data.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00267 Published 2026-10-08 Fixed in 10.0.6 CWE-79