CVE-2023-5965

PoC لـ Espo CRM 7.2.4 CVE-2023-5965 و CVE-2023-5965 CVE-2023-5965 إشعار يمكن لمهاجم موثوق يتمتع بامتيازات رفع ملف مضغوط مصمم خصيصًا إلى خادم EspoCRM في الإصدار 7.2.5، عبر نموذج التحديث، مما قد يؤدي إلى تنفيذ كود PHP عشوائي. لرفع الملف، انتقل إلى الإدارة = الترقيات CVE-2023-5966 إشعار يمكن لمهاجم...

EspoCRM <= 9.3.3 - Server-Side Request Forgery

EspoCRM = 9.3.3 contains an authenticated server-side request forgery caused by improper internal-host validation using alternative IPv4 formats in HostCheck::isNotInternalHost, letting authenticated users access internal resources via /api/v1/Attachment/fromImageUrl endpoint. id: CVE-2026-33534...

cve-2023-5966

PoC для CVE-2023-5966 Advisory EspoCRM 2.7.4 и более ранние версии уязвимы для произвольной загрузки файлов, что может привести к выполнению кода в функциональности добавления расширений. Zip-файл в этом репозитории загружает веб-шелл в /webshell.php...

ESPOCRM-RCE-POC-CVE-2026-33656

EspoCRM command Пример: ./poc.sh http://192.168.5.16:8090 admin admin id...

CVE-2026-33534

CVE-2026-33534 - SSRF authentifié sur EspoCRM 9.3.3 Preuve de concept de SSRF authentifié pour EspoCRM 9.3.3 via une notation alternative de bouclage IPv4 dans le point de terminaison /api/v1/Attachment/fromImageUrl. Résumé EspoCRM 9.3.3 bloque les URL de bouclage directes telles que...

CVE-2026-33657

CVE-2026-33657 - Injection HTML stockée dans EspoCRM 9.3.3 dans les notifications par e-mail Preuve de concept authentifiée pour l'injection HTML stockée dans les notifications par e-mail d'EspoCRM 9.3.3. Résumé EspoCRM 9.3.3 génère les e-mails de notification de flux en transformant le corps de ...

CVE-2026-105833

EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP...

CVE-2026-105832

EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly...

CVE-2026-105831

EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form data. The request body is stored in LeadCaptureLogRecord.data and rendered unescaped when administrators view the log record,...

CVE-2026-105833

EspoCRM versions before 10.0.5 are vulnerable to an Insecure Direct Object Reference (IDOR) in the PersonalAccount\Service component. This flaw allows users with Email Account scope access to retrieve the IMAP passwords of other users. If an attacker knows a victim's Email Account record ID, they...

CVE-2026-105832 EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes

EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly...

CVE-2026-105832 EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes

EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly...

CVE-2026-105832

EspoCRM versions before 10.0.6 are vulnerable to an authentication bypass flaw where the system accepts a login that is stopped at the second factor on routes not requiring authentication. An attacker possessing a 2FA-enabled user's credentials can bypass the second factor to access config parame...

EUVD-2026-95019

EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly...

CVE-2026-105833 EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwords

EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP...

EUVD-2026-95020

EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP...

CVE-2026-105831 EspoCRM before 10.0.6 Unauthenticated Stored HTML Injection via Lead Capture Form

EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form data. The request body is stored in LeadCaptureLogRecord.data and rendered unescaped when administrators view the log record,...

EUVD-2026-95018

EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form data. The request body is stored in LeadCaptureLogRecord.data and rendered unescaped when administrators view the log record,...

CVE-2026-105831

EspoCRM versions before 10.0.6 are vulnerable to an unauthenticated stored HTML injection vulnerability. An attacker can submit crafted data via a Lead Capture public form , which is stored in LeadCaptureLogRecord.data . When an administrator views the log record, the request body is rendered une...

PT-2026-107990

EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form data. The request body is stored in LeadCaptureLogRecord.data and rendered unescaped when administrators view the log record,...