Skip to content
Noroxi

espocrm records

40 published records for vendor espocrm.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
30%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 19
  3. 21
  4. 22
  5. 23
  6. 24
  7. 25
  8. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

40 records
  • CVE-2014-7985
    42Plan

    Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary local files via a ..

    CriticalCVSS 10.0No exploitEPSS 5%

    espocrm · espocrmOct 31, 2014

  • CVE-2026-33656
    36Monitor

    EspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment `sourceId`, exploitable by admin user

    CriticalCVSS 9.1Proof of conceptEPSS 1%

    espocrm · espocrmApr 22, 2026

  • CVE-2022-38843
    35Monitor

    EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server

    HighCVSS 8.8No exploitEPSS 1%

    espocrm · espocrmSep 16, 2022

  • CVE-2019-14351
    35Monitor

    EspoCRM 5.6.4 is vulnerable to user password hash enumeration.

    HighCVSS 8.8No exploitEPSS 1%

    espocrm · espocrmJul 28, 2019

  • CVE-2020-37094
    34Monitor

    EspoCRM 5.7.0 < 5.9.0 - Two-Factor Authentication Bypass via Auth Token Reuse Between Accounts with Identical Passwords

    HighCVSS 8.6No exploitEPSS 0%

    espocrm · espocrmFeb 3, 2026

  • CVE-2022-38844
    32Monitor

    CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloa

    HighCVSS 8.0No exploitEPSS 1%

    espocrm · espocrmSep 16, 2022

  • CVE-2023-5966
    28Monitor

    Unrestricted Upload of File with Dangerous Type in EspoCRM

    HighCVSS 7.2Proof of conceptEPSS 1%

    espocrm · espocrmNov 30, 2023

  • CVE-2023-5965
    28Monitor

    Unrestricted Upload of File with Dangerous Type in EspoCRM

    HighCVSS 7.2Proof of conceptEPSS 1%

    espocrm · espocrmNov 30, 2023

  • CVE-2026-33733
    28Monitor

    EspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and delete

    HighCVSS 7.2No exploitEPSS 1%

    espocrm · espocrmApr 22, 2026

  • CVE-2025-32390
    28Monitor

    EspoCRM vulnerable to HTML Injection into phishing, which may lead to account takeover

    HighCVSS 7.0No exploitEPSS 0%

    espocrm · espocrmMay 12, 2025

  • CVE-2025-52575
    26Monitor

    EspoCRM vulnerable to LDAP Injection through Improper Neutralization of Special Elements

    MediumCVSS 6.5No exploitEPSS 1%

    espocrm · espocrmJul 21, 2025

  • CVE-2023-46736
    26Monitor

    Server-Side Request Forgery in espocrm

    MediumCVSS 6.5No exploitEPSS 0%

    espocrm · espocrmDec 5, 2023

  • CVE-2025-32385
    26Monitor

    EspoCRM allows unrestricted Embedding in Iframe dashlet

    MediumCVSS 6.5No exploitEPSS 0%

    espocrm · espocrmApr 15, 2025

  • CVE-2025-52892
    26Monitor

    EspoCRM is vulnerable to access denial through double slash in URI corrupting router cache

    MediumCVSS 6.5No exploitEPSS 0%

    espocrm · espocrmAug 4, 2025

  • CVE-2019-14330
    24Monitor

    An issue was discovered in EspoCRM before 5.6.6.

    MediumCVSS 6.1No exploitEPSS 1%

    espocrm · espocrmJul 28, 2019

  • CVE-2019-14329
    24Monitor

    An issue was discovered in EspoCRM before 5.6.6.

    MediumCVSS 6.1No exploitEPSS 1%

    espocrm · espocrmJul 28, 2019

  • CVE-2019-14331
    24Monitor

    An issue was discovered in EspoCRM before 5.6.6.

    MediumCVSS 6.1No exploitEPSS 1%

    espocrm · espocrmJul 28, 2019

  • CVE-2019-13643
    24Monitor

    Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target

    MediumCVSS 6.1No exploitEPSS 1%

    espocrm · espocrmJul 17, 2019

  • CVE-2019-14349
    24Monitor

    EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for s

    MediumCVSS 6.1No exploitEPSS 1%

    espocrm · espocrmJul 28, 2019

  • CVE-2019-14350
    24Monitor

    EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base.

    MediumCVSS 6.1No exploitEPSS 1%

    espocrm · espocrmJul 28, 2019

  • CVE-2022-38845
    24Monitor

    Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending craf

    MediumCVSS 6.1No exploitEPSS 1%

    espocrm · espocrmSep 16, 2022

  • CVE-2024-24818
    23Monitor

    EspoCRM weakness in "Forgot password"

    MediumCVSS 5.9No exploitEPSS 1%

    espocrm · espocrmMar 20, 2024

  • CVE-2022-38846
    23Monitor

    EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel (HTTP).

    MediumCVSS 5.9No exploitEPSS 0%

    espocrm · espocrmSep 16, 2022

  • CVE-2014-7986
    21Monitor

    install/index.php in EspoCRM before 2.6.0 allows remote attackers to re-install the application via a 1 value in the installProcess paramete

    MediumCVSS 5.0No exploitEPSS 3%

    espocrm · espocrmOct 31, 2014

  • CVE-2019-14546
    21Monitor

    An issue was discovered in EspoCRM before 5.6.9.

    MediumCVSS 5.4No exploitEPSS 1%

    espocrm · espocrmAug 5, 2019