Lucene search
+L

407 matches found

Kitploit
Kitploit
added 2026/09/18 8:33 a.m.8 views

CVE-2023-5965

PoC for Espo CRM 7.2.4 CVE-2023-5965 & CVE-2023-5965 CVE-2023-5965 Advisory An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbitrary PHP code execution. To upload the file go to...

7.2CVSS7.3AI score0.0104EPSS
SaveExploits0
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.73 views

EspoCRM <= 9.3.3 - Server-Side Request Forgery

EspoCRM = 9.3.3 contains an authenticated server-side request forgery caused by improper internal-host validation using alternative IPv4 formats in HostCheck::isNotInternalHost, letting authenticated users access internal resources via /api/v1/Attachment/fromImageUrl endpoint. id: CVE-2026-33534...

4.3CVSS5.7AI score0.01978EPSS
SaveExploits5References2
Kitploit
Kitploit
added 2026/09/17 1:40 a.m.20 views

cve-2023-5966

Poc from CVE-2023-5966 Advisory EspoCRM 2.7.4 and earlier is vulnerable to an arbitrary file upload that can lead to code execution in the add extension functionality. The zip file on this repo upload a web shell to /webshell.php...

7.2CVSS7.6AI score0.0104EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/17 12:51 a.m.13 views

ESPOCRM-RCE-POC-CVE-2026-33656

EspoCRM = 9.3.3 CVE-2026-33656 — Authenticated RCE via Formula ACL Bypass + Attachment sourceId Path Traversal + .htaccess Poisoning Author : Jiva jivasecurity.com Writeup : https://jivasecurity.com/writeups/espocrm-rce-cve-2026-33656 Product : EspoCRM = 9.3.3 Auth : Admin credentials required...

9.1CVSS8.6AI score0.005EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/17 12:50 a.m.11 views

CVE-2026-33534

CVE-2026-33534 - EspoCRM 9.3.3 Authenticated SSRF Authenticated SSRF proof-of-concept for EspoCRM 9.3.3 via alternative IPv4 loopback notation in the /api/v1/Attachment/fromImageUrl endpoint. Summary EspoCRM 9.3.3 blocks direct loopback URLs such as http://127.0.0.1/..., but the server-side fetch...

4.3CVSS5.9AI score0.01978EPSS
SaveExploits5References1
Kitploit
Kitploit
added 2026/09/16 5:10 a.m.9 views

CVE-2026-33657

CVE-2026-33657 - EspoCRM 9.3.3 Stored HTML Injection in Email Notifications Authenticated proof-of-concept for stored HTML injection in EspoCRM 9.3.3 email notifications. Summary EspoCRM 9.3.3 renders stream-note notification emails by transforming the note body with Markdown and inserting the...

5.4CVSS5.9AI score0.00176EPSS
SaveExploits2
NVD
NVD
added 2026/09/16 2:17 a.m.8 views

CVE-2026-92298

EspoCRM through 10.0.8 uses PHP's rand function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event...

6.3CVSS0.00324EPSS
SaveExploits0References6
OSV
OSV
added 2026/09/16 1:57 a.m.4 views

CVE-2026-92298 EspoCRM through 10.0.8 Weak Token Generation via rand()

EspoCRM through 10.0.8 uses PHP's rand function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event...

6.3CVSS5.7AI score
SaveExploits0References8
CVE
CVE
added 2026/09/16 1:57 a.m.11 views

CVE-2026-92298

EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. The tokens are roughly 31-bit , allowing remote unauthenticated attackers to guess them and confirm opt-ins, accept or...

6.3CVSS5.7AI score0.00324EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/09/16 1:57 a.m.33 views

CVE-2026-92298 EspoCRM through 10.0.8 Weak Token Generation via rand()

EspoCRM through 10.0.8 uses PHP's rand function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event...

6.3CVSS0.00324EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/09/16 1:57 a.m.10 views

EUVD-2026-80078

EspoCRM through 10.0.8 uses PHP's rand function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event...

6.3CVSS5.7AI score0.00324EPSS
SaveExploits0References6
NVD
NVD
added 2026/09/14 1:19 p.m.6 views

CVE-2026-90934

EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent...

8.7CVSS0.00182EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/14 12:48 p.m.7 views

EUVD-2026-77452

EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent...

8.7CVSS5.8AI score0.00182EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/14 12:48 p.m.31 views

CVE-2026-90934 EspoCRM before 10.0.4 Field-level Security Bypass via Attendees

EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent...

8.7CVSS0.00182EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/14 12:48 p.m.9 views

CVE-2026-90934

EspoCRM before 10.0.4 is affected by a field-level security bypass in the meeting and call attendees endpoints. The root cause is incorrect ACL scope validation that checks parent event permissions instead of attendee entity permissions, allowing authenticated users to recover restricted email ad...

8.7CVSS5.8AI score0.00182EPSS
SaveExploits0References2
OSV
OSV
added 2026/09/14 12:48 p.m.6 views

CVE-2026-90934 EspoCRM before 10.0.4 Field-level Security Bypass via Attendees

EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent...

8.7CVSS5.8AI score
SaveExploits0References4
NVD
NVD
added 2026/09/10 2:17 p.m.7 views

CVE-2026-88896

EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal, which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: IPv4-mapped IPv6 prefixes but does not recognize IPv6 transition addresses that embed private IPv...

6.9CVSS0.00335EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/10 1:05 p.m.8 views

EUVD-2026-75446

EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal, which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: IPv4-mapped IPv6 prefixes but does not recognize IPv6 transition addresses that embed private IPv...

6.9CVSS5.7AI score0.00335EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/10 1:05 p.m.13 views

CVE-2026-88896

EspoCRM before 10.0.4 is vulnerable to Server-Side Request Forgery (SSRF) via an IPv6 transition address bypass in HostCheck::ipAddressIsNotInternal(). The function strips ::ffff: (IPv4-mapped IPv6) prefixes but fails to recognize IPv6 transition addresses that embed private IPv4 addresses—NAT64 ...

6.9CVSS5.7AI score0.00335EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/10 1:05 p.m.41 views

CVE-2026-88896 EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass

EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal, which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: IPv4-mapped IPv6 prefixes but does not recognize IPv6 transition addresses that embed private IPv...

6.9CVSS0.00335EPSS
SaveExploits0References2
Rows per page
Query Builder