# cve.now: Espocrm

The newest entries naming Espocrm as an affected vendor (up to 200), of 43 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-118686](https://cve.now/CVE-2026-118686.md): EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex (CVSS 8.7)
- [CVE-2026-75505](https://cve.now/CVE-2026-75505.md): EspoCRM: Access control bypass in Mass Update letting regular user with Mass Update permission read any attachment (CVSS 6.0)
- [CVE-2026-77460](https://cve.now/CVE-2026-77460.md): EspoCRM: Mass email template renderer leaks restricted record fields (CVSS 6.5)
- [CVE-2026-63130](https://cve.now/CVE-2026-63130.md): EspoCRM: Admin path traversal in LabelManager (Custom Label saving) allows arbitrary \`.json\` file read, write and delete (CVSS 5.5)
- [CVE-2026-59994](https://cve.now/CVE-2026-59994.md): EspoCRM: Pre-authentication stored HTML injection in stream notification emails about email received (CVSS 4.3)
- [CVE-2026-55154](https://cve.now/CVE-2026-55154.md): EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export (CVSS 5.4)
- [CVE-2026-55184](https://cve.now/CVE-2026-55184.md): EspoCRM: Stored XSS in wysiwyg template fields if CSP is disabled (CVSS 3.5)
- [CVE-2026-53575](https://cve.now/CVE-2026-53575.md): EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user (CVSS 2.7)
- [CVE-2026-53574](https://cve.now/CVE-2026-53574.md): EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression (CVSS 7.6)
- [CVE-2026-46691](https://cve.now/CVE-2026-46691.md): EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users (CVSS 6.5)
- [CVE-2026-46708](https://cve.now/CVE-2026-46708.md): EspoCRM: Target list Opt-Out actions allows opting out record without access Target List and access to record (CVSS 4.3)
- [CVE-2026-47168](https://cve.now/CVE-2026-47168.md): EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params (CVSS 9.1)
- [CVE-2026-46694](https://cve.now/CVE-2026-46694.md): EspoCRM: Portal User ACL Bypass Exposes Internal Stream Notes (CVSS 6.5)
- [CVE-2026-109959](https://cve.now/CVE-2026-109959.md): EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint (CVSS 5.3)
- [CVE-2026-109958](https://cve.now/CVE-2026-109958.md): EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search (CVSS 5.3)
- [CVE-2026-109957](https://cve.now/CVE-2026-109957.md): EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter (CVSS 5.3)
- [CVE-2026-105833](https://cve.now/CVE-2026-105833.md): EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwords (CVSS 8.3)
- [CVE-2026-105832](https://cve.now/CVE-2026-105832.md): EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes (CVSS 5.3)
- [CVE-2026-105831](https://cve.now/CVE-2026-105831.md): EspoCRM before 10.0.6 Unauthenticated Stored HTML Injection via Lead Capture Form (CVSS 5.3)
- [CVE-2026-92298](https://cve.now/CVE-2026-92298.md): EspoCRM through 10.0.8 Weak Token Generation via rand() (CVSS 4.8)
- [CVE-2026-90934](https://cve.now/CVE-2026-90934.md): EspoCRM before 10.0.4 Field-level Security Bypass via Attendees (CVSS 8.7)
- [CVE-2026-88896](https://cve.now/CVE-2026-88896.md): EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass (CVSS 6.9)
- [CVE-2026-41141](https://cve.now/CVE-2026-41141.md): EspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity Data via Email Address Lookup (CVSS 6.5)
- [CVE-2026-41160](https://cve.now/CVE-2026-41160.md): EspoCRM: Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of notes (CVSS 4.3)
- [CVE-2026-33741](https://cve.now/CVE-2026-33741.md): EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript (CVSS 6.8)
- [CVE-2026-33733](https://cve.now/CVE-2026-33733.md): EspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and delete (CVSS 7.2)
- [CVE-2026-33656](https://cve.now/CVE-2026-33656.md): EspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment \`sourceId\`, exploitable by admin user (CVSS 9.1)
- [CVE-2026-33740](https://cve.now/CVE-2026-33740.md): EspoCRM: Email importEml can import and delete another user's attachment by raw fileId (CVSS 5.4)
- [CVE-2026-33659](https://cve.now/CVE-2026-33659.md): EspoCRM: SSRF via DNS Rebinding in Attachment fromImageUrl Endpoint Allows Internal Network Access (CVSS 3.5)
- [CVE-2026-33657](https://cve.now/CVE-2026-33657.md): EspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field (CVSS 4.6)
- [CVE-2026-33534](https://cve.now/CVE-2026-33534.md): EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation (CVSS 4.3)
- [CVE-2020-37094](https://cve.now/CVE-2020-37094.md): EspoCRM 5.7.0 \< 5.9.0 - Two-Factor Authentication Bypass via Auth Token Reuse Between Accounts with Identical Passwords (CVSS 8.6)
- [CVE-2025-59428](https://cve.now/CVE-2025-59428.md): EspoCRM allows arbitrary user creation via stored SVG injection and CSRF (CVSS 5.4)
- [CVE-2025-52892](https://cve.now/CVE-2025-52892.md): EspoCRM is vulnerable to access denial through double slash in URI corrupting router cache (CVSS 4.5)
- [CVE-2025-52575](https://cve.now/CVE-2025-52575.md): EspoCRM vulnerable to LDAP Injection through Improper Neutralization of Special Elements (CVSS 6.5)
- [CVE-2025-32390](https://cve.now/CVE-2025-32390.md): EspoCRM vulnerable to HTML Injection into phishing, which may lead to account takeover (CVSS 7.0)
- [CVE-2025-32789](https://cve.now/CVE-2025-32789.md): EspoCRM Allows Potential Disclosure of Sensitive Information in the User Sorting Function (CVSS 3.1)
- [CVE-2025-32385](https://cve.now/CVE-2025-32385.md): EspoCRM allows unrestricted Embedding in Iframe dashlet (CVSS 5.3)
- [CVE-2024-24818](https://cve.now/CVE-2024-24818.md): EspoCRM weakness in "Forgot password" (CVSS 5.9)
- [CVE-2023-46736](https://cve.now/CVE-2023-46736.md): Server-Side Request Forgery in espocrm (CVSS 5.3)
- [CVE-2023-5966](https://cve.now/CVE-2023-5966.md): Unrestricted Upload of File with Dangerous Type in EspoCRM (CVSS 4.7)
- [CVE-2023-5965](https://cve.now/CVE-2023-5965.md): Unrestricted Upload of File with Dangerous Type in EspoCRM (CVSS 4.7)
- [CVE-2021-3539](https://cve.now/CVE-2021-3539.md): EspoCRM Avatar Persistent XSS (CVSS 6.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/espocrm
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.