ES
Product
espocrm
66
CVEs
0
On KEV
9.1
Max CVSS
20
New 30D
Severity mix
Critical 2High 11Medium 45Low 4
Watch
Add espocrm to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-38843 | 8.8 | Sep 16 | EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server Affected: 7.1.8 |
| CVE-2019-14351 | 8.8 | Jul 28 | EspoCRM 5.6.4 is vulnerable to user password hash enumeration Affected: 5.6.4 |
| CVE-2025-32390 | 8.5 | May 12 | EspoCRM vulnerable to HTML Injection into phishing, which may lead to account takeover Affected: < 9.0.8 |
| CVE-2020-37094 | 8.1 | Feb 3 | EspoCRM 5.7.0 < 5.9.0 - Two-Factor Authentication Bypass via Auth Token Reuse Between Accounts with Identical Passwords Affected: 5.7.0 before 5.9.0 |
| CVE-2022-38844 | 8.0 | Sep 16 | CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands Affected: 7.1.8 |
| CVE-2026-105833 | 7.7 | Oct 8 | EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwords Affected: before 10.0.5 |
| CVE-2026-53574 | 7.6 | Oct 15 | EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression Affected: >= 8.1.0, < 9.3.8 |
| CVE-2026-118686 New | 7.5 | Oct 28 | EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex Affected: 10.0.0 before 10.0.8; before 9.3.11 |
| CVE-2026-33733 | 7.2 | Apr 22 | EspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and delete Affected: < 9.3.4 |
| CVE-2023-5966 | 7.2 | Nov 30 | Unrestricted Upload of File with Dangerous Type in EspoCRM Affected: through 7.5.2 |
| CVE-2023-5965 | 7.2 | Nov 30 | Unrestricted Upload of File with Dangerous Type in EspoCRM Affected: through 7.5.2 |
Showing 11