Skip to content
OpenAdvisories

Vendor

espocrm

43 known vulnerabilities.

Products

espocrm 43
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 4.6
    CVE-2026-33657 Public exploit

    EspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field

    EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have a stored HTML injection vulnerability that allows any authenticated user with standard (non-administrative) privileges to inject arbitrary HTML into system-g…

    espocrm espocrm
  • Medium 4.3
    CVE-2026-33534 Public exploit

    EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation

    EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have an authenticated Server-Side Request Forgery (SSRF) vulnerability that allows bypassing the internal-host validation logic by using alternative IPv4 represen…

    espocrm espocrm
  • Medium 4.7
    CVE-2023-5966 Public exploit

    Unrestricted Upload of File with Dangerous Type in EspoCRM

    An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the extension deployment form, which could lead to arbitrary PHP code execution.

    espocrm espocrm
  • Medium 4.7
    CVE-2023-5965 Public exploit

    Unrestricted Upload of File with Dangerous Type in EspoCRM

    An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbitrary PHP code execution.

    espocrm espocrm