Skip to content
OpenAdvisories

Vendor

espocrm

43 known vulnerabilities.

Products

espocrm 43
All Critical High Medium Low Exploited only Public exploit

43 results · Feed

  • Medium 4.7
    CVE-2023-5966 Public exploit

    Unrestricted Upload of File with Dangerous Type in EspoCRM

    An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the extension deployment form, which could lead to arbitrary PHP code execution.

    espocrm espocrm
  • Medium 4.7
    CVE-2023-5965 Public exploit

    Unrestricted Upload of File with Dangerous Type in EspoCRM

    An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbitrary PHP code execution.

    espocrm espocrm
  • Medium 6.3
    CVE-2021-3539

    EspoCRM Avatar Persistent XSS

    EspoCRM 6.1.6 and prior suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. This issue was fixed in version 6.1.7 of the product.

    espocrm espocrm