EspoCRM vulnerabilities
3 known CVE vulnerabilities in EspoCRM, translated and rated.
- CVE-2014-7985High
Directory traversal vulnerability in EspoCRM before version 2.6.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter to install/index.php.
- CVE-2026-33741Medium
EspoCRM versions 9.3.3 and below allow authenticated users to upload SVG attachments through normal attachment-capable fields and later serve those SVG files as top-level inline documents, resulting in stored cross-user XSS. Although inline SVG script is blocked by CSP, same-origin external script is allowed, so an attacker can upload a malicious SVG together with a second attacker-controlled JavaScript attachment and trick another user into opening the SVG to execute JavaScript.
- CVE-2020-37094High
A vulnerability in EspoCRM 5.7.0 through 5.9.0 allows authenticated attackers to bypass two-factor authentication by reusing authentication tokens bound to password hashes. This enables token replay against any victim account sharing the same password.