agentprime: espocrmEvery new CVE for espocrm.https://agentprime.io/CVE-2026-118686: EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regexhttps://agentprime.io/advisories/CVE-2026-118686/https://agentprime.io/advisories/CVE-2026-118686/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 18:59:55 GMTCVECVE-2026-113643: EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorizationhttps://agentprime.io/advisories/CVE-2026-113643/https://agentprime.io/advisories/CVE-2026-113643/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Oct 2026 18:15:12 GMTCVECVE-2026-75505: EspoCRM: Access control bypass in Mass Update letting regular user with Mass Update permission read any attachmenthttps://agentprime.io/advisories/CVE-2026-75505/https://agentprime.io/advisories/CVE-2026-75505/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 15:04:02 GMTCVECVE-2026-77460: EspoCRM: Mass email template renderer leaks restricted record fieldshttps://agentprime.io/advisories/CVE-2026-77460/https://agentprime.io/advisories/CVE-2026-77460/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 14:58:44 GMTCVECVE-2026-63130: EspoCRM: Admin path traversal in LabelManager (Custom Label saving) allows arbitrary `.json` file read, write and deletehttps://agentprime.io/advisories/CVE-2026-63130/https://agentprime.io/advisories/CVE-2026-63130/CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 14:56:57 GMTCVECVE-2026-59994: EspoCRM: Pre-authentication stored HTML injection in stream notification emails about email receivedhttps://agentprime.io/advisories/CVE-2026-59994/https://agentprime.io/advisories/CVE-2026-59994/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 14:50:04 GMTCVECVE-2026-55154: EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in exporthttps://agentprime.io/advisories/CVE-2026-55154/https://agentprime.io/advisories/CVE-2026-55154/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 14:49:15 GMTCVECVE-2026-55184: EspoCRM: Stored XSS in wysiwyg template fields if CSP is disabledhttps://agentprime.io/advisories/CVE-2026-55184/https://agentprime.io/advisories/CVE-2026-55184/CVSS 3.5 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 14:48:03 GMTCVECVE-2026-53575: EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin userhttps://agentprime.io/advisories/CVE-2026-53575/https://agentprime.io/advisories/CVE-2026-53575/CVSS 2.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 14:47:19 GMTCVECVE-2026-53574: EspoCRM: Blind SQL injection via streamAttachments where-clause complex expressionhttps://agentprime.io/advisories/CVE-2026-53574/https://agentprime.io/advisories/CVE-2026-53574/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 14:45:52 GMTCVECVE-2026-46691: EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Usershttps://agentprime.io/advisories/CVE-2026-46691/https://agentprime.io/advisories/CVE-2026-46691/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 14:45:03 GMTCVECVE-2026-46708: EspoCRM: Target list Opt-Out actions allows opting out record without access Target List and access to recordhttps://agentprime.io/advisories/CVE-2026-46708/https://agentprime.io/advisories/CVE-2026-46708/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 14:44:18 GMTCVECVE-2026-47168: EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export paramshttps://agentprime.io/advisories/CVE-2026-47168/https://agentprime.io/advisories/CVE-2026-47168/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 14:42:15 GMTCVEcriticalCVE-2026-46694: EspoCRM: Portal User ACL Bypass Exposes Internal Stream Noteshttps://agentprime.io/advisories/CVE-2026-46694/https://agentprime.io/advisories/CVE-2026-46694/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 14:40:49 GMTCVECVE-2026-109959: EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpointhttps://agentprime.io/advisories/CVE-2026-109959/https://agentprime.io/advisories/CVE-2026-109959/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Oct 2026 13:27:22 GMTCVECVE-2026-109958: EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Searchhttps://agentprime.io/advisories/CVE-2026-109958/https://agentprime.io/advisories/CVE-2026-109958/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Oct 2026 13:27:21 GMTCVECVE-2026-109957: EspoCRM before 10.0.7 IDOR via Import attachmentId Parameterhttps://agentprime.io/advisories/CVE-2026-109957/https://agentprime.io/advisories/CVE-2026-109957/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Oct 2026 13:27:20 GMTCVECVE-2026-105833: EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwordshttps://agentprime.io/advisories/CVE-2026-105833/https://agentprime.io/advisories/CVE-2026-105833/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 08 Oct 2026 14:10:32 GMTCVECVE-2026-105832: EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routeshttps://agentprime.io/advisories/CVE-2026-105832/https://agentprime.io/advisories/CVE-2026-105832/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 08 Oct 2026 14:10:32 GMTCVECVE-2026-105831: EspoCRM before 10.0.6 Unauthenticated Stored HTML Injection via Lead Capture Formhttps://agentprime.io/advisories/CVE-2026-105831/https://agentprime.io/advisories/CVE-2026-105831/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 08 Oct 2026 14:10:31 GMTCVECVE-2026-92298: EspoCRM through 10.0.8 Weak Token Generation via rand()https://agentprime.io/advisories/CVE-2026-92298/https://agentprime.io/advisories/CVE-2026-92298/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 01:57:46 GMTCVECVE-2026-90934: EspoCRM before 10.0.4 Field-level Security Bypass via Attendeeshttps://agentprime.io/advisories/CVE-2026-90934/https://agentprime.io/advisories/CVE-2026-90934/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 12:48:29 GMTCVECVE-2026-88896: EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypasshttps://agentprime.io/advisories/CVE-2026-88896/https://agentprime.io/advisories/CVE-2026-88896/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 10 Sep 2026 13:05:43 GMTCVECVE-2026-41141: EspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity Data via Email Address Lookuphttps://agentprime.io/advisories/CVE-2026-41141/https://agentprime.io/advisories/CVE-2026-41141/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 28 May 2026 16:25:03 GMTCVECVE-2026-41160: EspoCRM: Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of noteshttps://agentprime.io/advisories/CVE-2026-41160/https://agentprime.io/advisories/CVE-2026-41160/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 28 May 2026 16:24:19 GMTCVECVE-2026-33741: EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScripthttps://agentprime.io/advisories/CVE-2026-33741/https://agentprime.io/advisories/CVE-2026-33741/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 19 May 2026 18:14:36 GMTCVECVE-2026-33733: EspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and deletehttps://agentprime.io/advisories/CVE-2026-33733/https://agentprime.io/advisories/CVE-2026-33733/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 22 Apr 2026 20:05:23 GMTCVECVE-2026-33656: EspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment `sourceId`, exploitable by admin userhttps://agentprime.io/advisories/CVE-2026-33656/https://agentprime.io/advisories/CVE-2026-33656/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 22 Apr 2026 20:01:24 GMTCVEcriticalCVE-2026-33740: EspoCRM: Email importEml can import and delete another user's attachment by raw fileIdhttps://agentprime.io/advisories/CVE-2026-33740/https://agentprime.io/advisories/CVE-2026-33740/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 13 Apr 2026 20:37:28 GMTCVECVE-2026-33659: EspoCRM: SSRF via DNS Rebinding in Attachment fromImageUrl Endpoint Allows Internal Network Accesshttps://agentprime.io/advisories/CVE-2026-33659/https://agentprime.io/advisories/CVE-2026-33659/CVSS 3.5 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 13 Apr 2026 20:32:07 GMTCVECVE-2026-33657: EspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post fieldhttps://agentprime.io/advisories/CVE-2026-33657/https://agentprime.io/advisories/CVE-2026-33657/CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 13 Apr 2026 19:41:47 GMTCVECVE-2026-33534: EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notationhttps://agentprime.io/advisories/CVE-2026-33534/https://agentprime.io/advisories/CVE-2026-33534/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 13 Apr 2026 19:20:04 GMTCVECVE-2020-37094: EspoCRM 5.7.0 < 5.9.0 - Two-Factor Authentication Bypass via Auth Token Reuse Between Accounts with Identical Passwordshttps://agentprime.io/advisories/CVE-2020-37094/https://agentprime.io/advisories/CVE-2020-37094/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Feb 2026 22:01:52 GMTCVECVE-2025-59428: EspoCRM allows arbitrary user creation via stored SVG injection and CSRFhttps://agentprime.io/advisories/CVE-2025-59428/https://agentprime.io/advisories/CVE-2025-59428/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Oct 2025 14:38:20 GMTCVECVE-2025-52892: EspoCRM is vulnerable to access denial through double slash in URI corrupting router cachehttps://agentprime.io/advisories/CVE-2025-52892/https://agentprime.io/advisories/CVE-2025-52892/CVSS 4.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 05 Aug 2025 00:17:16 GMTCVECVE-2025-52575: EspoCRM vulnerable to LDAP Injection through Improper Neutralization of Special Elementshttps://agentprime.io/advisories/CVE-2025-52575/https://agentprime.io/advisories/CVE-2025-52575/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Jul 2025 17:48:11 GMTCVECVE-2025-32390: EspoCRM vulnerable to HTML Injection into phishing, which may lead to account takeoverhttps://agentprime.io/advisories/CVE-2025-32390/https://agentprime.io/advisories/CVE-2025-32390/CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 May 2025 10:30:52 GMTCVECVE-2025-32789: EspoCRM Allows Potential Disclosure of Sensitive Information in the User Sorting Functionhttps://agentprime.io/advisories/CVE-2025-32789/https://agentprime.io/advisories/CVE-2025-32789/CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Apr 2025 21:45:21 GMTCVECVE-2025-32385: EspoCRM allows unrestricted Embedding in Iframe dashlethttps://agentprime.io/advisories/CVE-2025-32385/https://agentprime.io/advisories/CVE-2025-32385/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Apr 2025 23:23:58 GMTCVECVE-2024-24818: EspoCRM weakness in "Forgot password"https://agentprime.io/advisories/CVE-2024-24818/https://agentprime.io/advisories/CVE-2024-24818/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Feb 2024 15:17:16 GMTCVECVE-2023-46736: Server-Side Request Forgery in espocrmhttps://agentprime.io/advisories/CVE-2023-46736/https://agentprime.io/advisories/CVE-2023-46736/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 05 Dec 2023 20:55:42 GMTCVECVE-2023-5966: Unrestricted Upload of File with Dangerous Type in EspoCRMhttps://agentprime.io/advisories/CVE-2023-5966/https://agentprime.io/advisories/CVE-2023-5966/CVSS 4.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 30 Nov 2023 13:26:48 GMTCVECVE-2023-5965: Unrestricted Upload of File with Dangerous Type in EspoCRMhttps://agentprime.io/advisories/CVE-2023-5965/https://agentprime.io/advisories/CVE-2023-5965/CVSS 4.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 30 Nov 2023 13:26:15 GMTCVECVE-2021-3539: EspoCRM Avatar Persistent XSShttps://agentprime.io/advisories/CVE-2021-3539/https://agentprime.io/advisories/CVE-2021-3539/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Aug 2021 22:20:47 GMTCVE