Espocrm vulnerabilities
43 CVEs and advisories name Espocrm as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-33534EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation
- CVE-2020-37094EspoCRM 5.7.0 < 5.9.0 - Two-Factor Authentication Bypass via Auth Token Reuse Between Accounts with Identical Passwords
- CVE-2025-59428EspoCRM allows arbitrary user creation via stored SVG injection and CSRF
- CVE-2025-52892EspoCRM is vulnerable to access denial through double slash in URI corrupting router cache
- CVE-2025-52575EspoCRM vulnerable to LDAP Injection through Improper Neutralization of Special Elements
- CVE-2025-32390EspoCRM vulnerable to HTML Injection into phishing, which may lead to account takeover
- CVE-2025-32789EspoCRM Allows Potential Disclosure of Sensitive Information in the User Sorting Function
- CVE-2025-32385EspoCRM allows unrestricted Embedding in Iframe dashlet
- CVE-2024-24818EspoCRM weakness in "Forgot password"
- CVE-2023-46736Server-Side Request Forgery in espocrm
- CVE-2023-5966Unrestricted Upload of File with Dangerous Type in EspoCRM
- CVE-2023-5965Unrestricted Upload of File with Dangerous Type in EspoCRM
- CVE-2021-3539EspoCRM Avatar Persistent XSS