# espocrm.

Every CVE that names espocrm among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex](https://agentprime.io/advisories/CVE-2026-118686.md)
  `CVE-2026-118686` · CVE record: espocrm espocrm · CVSS 8.7 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service
- [EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization](https://agentprime.io/advisories/CVE-2026-113643.md)
  `CVE-2026-113643` · CVE record: EspoCRM · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [EspoCRM: Access control bypass in Mass Update letting regular user with Mass Update permission read any attachment](https://agentprime.io/advisories/CVE-2026-75505.md)
  `CVE-2026-75505` · CVE record: espocrm espocrm · CVSS 6.0 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [EspoCRM: Mass email template renderer leaks restricted record fields](https://agentprime.io/advisories/CVE-2026-77460.md)
  `CVE-2026-77460` · CVE record: espocrm espocrm · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [EspoCRM: Admin path traversal in LabelManager (Custom Label saving) allows arbitrary \`.json\` file read, write and delete](https://agentprime.io/advisories/CVE-2026-63130.md)
  `CVE-2026-63130` · CVE record: espocrm espocrm · CVSS 5.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [EspoCRM: Pre-authentication stored HTML injection in stream notification emails about email received](https://agentprime.io/advisories/CVE-2026-59994.md)
  `CVE-2026-59994` · CVE record: espocrm espocrm · CVSS 4.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export](https://agentprime.io/advisories/CVE-2026-55154.md)
  `CVE-2026-55154` · CVE record: espocrm espocrm · CVSS 5.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Other injection
- [EspoCRM: Stored XSS in wysiwyg template fields if CSP is disabled](https://agentprime.io/advisories/CVE-2026-55184.md)
  `CVE-2026-55184` · CVE record: espocrm espocrm · CVSS 3.5 Low · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user](https://agentprime.io/advisories/CVE-2026-53575.md)
  `CVE-2026-53575` · CVE record: espocrm espocrm · CVSS 2.7 Low · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression](https://agentprime.io/advisories/CVE-2026-53574.md)
  `CVE-2026-53574` · CVE record: espocrm espocrm · CVSS 7.6 High · Not analysed yet · Published 15 Oct 2026 · Tags: SQL injection
- [EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users](https://agentprime.io/advisories/CVE-2026-46691.md)
  `CVE-2026-46691` · CVE record: espocrm espocrm · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [EspoCRM: Target list Opt-Out actions allows opting out record without access Target List and access to record](https://agentprime.io/advisories/CVE-2026-46708.md)
  `CVE-2026-46708` · CVE record: espocrm espocrm · CVSS 4.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params](https://agentprime.io/advisories/CVE-2026-47168.md)
  `CVE-2026-47168` · CVE record: espocrm espocrm · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Insecure deserialization
- [EspoCRM: Portal User ACL Bypass Exposes Internal Stream Notes](https://agentprime.io/advisories/CVE-2026-46694.md)
  `CVE-2026-46694` · CVE record: espocrm espocrm · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint](https://agentprime.io/advisories/CVE-2026-109959.md)
  `CVE-2026-109959` · CVE record: espocrm espocrm · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure
- [EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search](https://agentprime.io/advisories/CVE-2026-109958.md)
  `CVE-2026-109958` · CVE record: espocrm espocrm · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure
- [EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter](https://agentprime.io/advisories/CVE-2026-109957.md)
  `CVE-2026-109957` · CVE record: espocrm espocrm · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwords](https://agentprime.io/advisories/CVE-2026-105833.md)
  `CVE-2026-105833` · CVE record: espocrm espocrm · CVSS 8.3 High · Not analysed yet · Published 8 Oct 2026 · Tags: Hard-coded credentials
- [EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes](https://agentprime.io/advisories/CVE-2026-105832.md)
  `CVE-2026-105832` · CVE record: espocrm espocrm · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass
- [EspoCRM before 10.0.6 Unauthenticated Stored HTML Injection via Lead Capture Form](https://agentprime.io/advisories/CVE-2026-105831.md)
  `CVE-2026-105831` · CVE record: espocrm espocrm · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Cross-site scripting (XSS)
- [EspoCRM through 10.0.8 Weak Token Generation via rand()](https://agentprime.io/advisories/CVE-2026-92298.md)
  `CVE-2026-92298` · CVE record: EspoCRM EspoCRM · CVSS 6.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Weak cryptography or TLS
- [EspoCRM before 10.0.4 Field-level Security Bypass via Attendees](https://agentprime.io/advisories/CVE-2026-90934.md)
  `CVE-2026-90934` · CVE record: espocrm espocrm · CVSS 8.7 High · Not analysed yet · Published 14 Sept 2026 · Tags: Broken access control
- [EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass](https://agentprime.io/advisories/CVE-2026-88896.md)
  `CVE-2026-88896` · CVE record: espocrm espocrm · CVSS 6.9 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [EspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity Data via Email Address Lookup](https://agentprime.io/advisories/CVE-2026-41141.md)
  `CVE-2026-41141` · CVE record: espocrm espocrm · CVSS 6.5 Medium · Not analysed yet · Published 28 May 2026 · Tags: Broken access control
- [EspoCRM: Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of notes](https://agentprime.io/advisories/CVE-2026-41160.md)
  `CVE-2026-41160` · CVE record: espocrm espocrm · CVSS 4.3 Medium · Not analysed yet · Published 28 May 2026 · Tags: Broken access control
- [EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript](https://agentprime.io/advisories/CVE-2026-33741.md)
  `CVE-2026-33741` · CVE record: espocrm espocrm · CVSS 6.8 Medium · Not analysed yet · Published 19 May 2026 · Tags: Cross-site scripting (XSS)
- [EspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and delete](https://agentprime.io/advisories/CVE-2026-33733.md)
  `CVE-2026-33733` · CVE record: espocrm espocrm · CVSS 7.2 High · Not analysed yet · Published 22 Apr 2026 · Tags: Path traversal
- [EspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment \`sourceId\`, exploitable by admin user](https://agentprime.io/advisories/CVE-2026-33656.md)
  `CVE-2026-33656` · CVE record: espocrm espocrm · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Apr 2026 · Tags: Path traversal
- [EspoCRM: Email importEml can import and delete another user's attachment by raw fileId](https://agentprime.io/advisories/CVE-2026-33740.md)
  `CVE-2026-33740` · CVE record: espocrm espocrm · CVSS 5.4 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Broken access control
- [EspoCRM: SSRF via DNS Rebinding in Attachment fromImageUrl Endpoint Allows Internal Network Access](https://agentprime.io/advisories/CVE-2026-33659.md)
  `CVE-2026-33659` · CVE record: espocrm espocrm · CVSS 3.5 Low · Not analysed yet · Published 13 Apr 2026 · Tags: Race condition, Server-side request forgery (SSRF)
- [EspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field](https://agentprime.io/advisories/CVE-2026-33657.md)
  `CVE-2026-33657` · CVE record: espocrm espocrm · CVSS 4.6 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation](https://agentprime.io/advisories/CVE-2026-33534.md)
  `CVE-2026-33534` · CVE record: espocrm espocrm · CVSS 4.3 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [EspoCRM 5.7.0 < 5.9.0 - Two-Factor Authentication Bypass via Auth Token Reuse Between Accounts with Identical Passwords](https://agentprime.io/advisories/CVE-2020-37094.md)
  `CVE-2020-37094` · CVE record: EspoCRM EspoCRM · CVSS 8.6 High · Not analysed yet · Published 3 Feb 2026 · Tags: Authentication bypass
- [EspoCRM allows arbitrary user creation via stored SVG injection and CSRF](https://agentprime.io/advisories/CVE-2025-59428.md)
  `CVE-2025-59428` · CVE record: espocrm espocrm · CVSS 5.4 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Cross-site request forgery (CSRF)
- [EspoCRM is vulnerable to access denial through double slash in URI corrupting router cache](https://agentprime.io/advisories/CVE-2025-52892.md)
  `CVE-2025-52892` · CVE record: espocrm espocrm · CVSS 4.5 Medium · Not analysed yet · Published 5 Aug 2025 · Tags: HTTP request smuggling
- [EspoCRM vulnerable to LDAP Injection through Improper Neutralization of Special Elements](https://agentprime.io/advisories/CVE-2025-52575.md)
  `CVE-2025-52575` · CVE record: espocrm espocrm · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2025 · Tags: Other injection
- [EspoCRM vulnerable to HTML Injection into phishing, which may lead to account takeover](https://agentprime.io/advisories/CVE-2025-32390.md)
  `CVE-2025-32390` · CVE record: espocrm espocrm · CVSS 7.0 High · Not analysed yet · Published 12 May 2025 · Tags: Other injection
- [EspoCRM Allows Potential Disclosure of Sensitive Information in the User Sorting Function](https://agentprime.io/advisories/CVE-2025-32789.md)
  `CVE-2025-32789` · CVE record: espocrm espocrm · CVSS 3.1 Low · Not analysed yet · Published 16 Apr 2025 · Tags: Information disclosure
- [EspoCRM allows unrestricted Embedding in Iframe dashlet](https://agentprime.io/advisories/CVE-2025-32385.md)
  `CVE-2025-32385` · CVE record: espocrm espocrm · CVSS 5.3 Medium · Not analysed yet · Published 15 Apr 2025 · Tags: CWE-1021
- [EspoCRM weakness in "Forgot password"](https://agentprime.io/advisories/CVE-2024-24818.md)
  `CVE-2024-24818` · CVE record: espocrm espocrm · CVSS 5.9 Medium · Not analysed yet · Published 29 Feb 2024 · Tags: CWE-610
- [Server-Side Request Forgery in espocrm](https://agentprime.io/advisories/CVE-2023-46736.md)
  `CVE-2023-46736` · CVE record: espocrm espocrm · CVSS 5.3 Medium · Not analysed yet · Published 5 Dec 2023 · Tags: Server-side request forgery (SSRF)
- [Unrestricted Upload of File with Dangerous Type in EspoCRM](https://agentprime.io/advisories/CVE-2023-5966.md)
  `CVE-2023-5966` · CVE record: EspoCRM EspoCRM · CVSS 4.7 Medium · Not analysed yet · Published 30 Nov 2023 · Tags: Unrestricted file upload
- [Unrestricted Upload of File with Dangerous Type in EspoCRM](https://agentprime.io/advisories/CVE-2023-5965.md)
  `CVE-2023-5965` · CVE record: EspoCRM EspoCRM · CVSS 4.7 Medium · Not analysed yet · Published 30 Nov 2023 · Tags: Unrestricted file upload
- [EspoCRM Avatar Persistent XSS](https://agentprime.io/advisories/CVE-2021-3539.md)
  `CVE-2021-3539` · CVE record: EspoCRM EspoCRM · CVSS 6.3 Medium · Not analysed yet · Published 4 Aug 2021 · Tags: Cross-site scripting (XSS)

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=espocrm>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/espocrm/>. Everything for agents: <https://agentprime.io/llms.txt>.