Skip to content
OpenAdvisories

Vendor

espocrm

43 known vulnerabilities.

Products

espocrm 43
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-47168

    EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params

    EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the app…

    espocrm espocrm
  • Critical 9.1
    CVE-2026-33656 Public exploit

    EspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment `sourceId`, exploitable by admin user

    EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formula scripting engine allowing updating attachment's sourceId thus allowing an authenticated admin to overwrite the `sourceId` field on `Atta…

    espocrm espocrm