CVE-2026-59994

The open source CRM application EspoCRM is vulnerable to a pre-authentication stored HTML injection in versions prior to 9.3.9 . An unauthenticated remote attacker can send an email to a monitored group, IMAP address, or email-to-Case address containing arbitrary HTML in the plain-text body. Espo...

EUVD-2026-102105

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Format/Csv/Processor.php, application/Espo/Tools/Export/Format/Xlsx/OpenSpoutProcessor.php, and application/Espo/Tools/Export/Format/Xlsx/PhpSpreadsheetProcessor.php inspect only...

CVE-2026-55154

The open source CRM application EspoCRM is vulnerable to CSV/Formula Injection in versions prior to 9.3.9 . The root cause is a sanitizer bypass in sanitizeCellValue() within Processor.php files for CSV and XLSX formats, which only inspect the first byte. An authenticated low-privileged user can ...

CVE-2026-55184 EspoCRM: Stored XSS in wysiwyg template fields if CSP is disabled

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, a user with Email Template or PDF Template edit permission can store crafted HTML that bypasses moderateSanitizeHtml. When another user opens the template in edit mode and clientCspDisabled is true, the stored...

EUVD-2026-102104

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, a user with Email Template or PDF Template edit permission can store crafted HTML that bypasses moderateSanitizeHtml. When another user opens the template in edit mode and clientCspDisabled is true, the stored...

CVE-2026-55184

The open source customer relationship management application EspoCRM is vulnerable to Stored XSS in wysiwyg template fields prior to version 9.3.9 . A user with permissions to edit Email Templates or PDF Templates can inject crafted HTML that bypasses the moderateSanitizeHtml() function. If anoth...

CVE-2026-53575

The open source customer relationship management application EspoCRM is vulnerable to a Persistent Cross-Site Scripting (XSS) flaw in versions prior to 9.3.9 . An authenticated administrator can inject crafted content into the applicationName setting using a CSP nonce injection . Because this inp...

EUVD-2026-102103

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authenticated administrator can place crafted content in the applicationName setting through CSP nonce injection. The persistent injection is inserted into the main application page without escaping, allowi...

CVE-2026-53575 EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authenticated administrator can place crafted content in the applicationName setting through CSP nonce injection. The persistent injection is inserted into the main application page without escaping, allowi...

CVE-2026-53574 EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression

EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injecti...

EUVD-2026-102101

EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injecti...

CVE-2026-53574

The open-source customer relationship management application EspoCRM is vulnerable to a boolean-based blind SQL injection in versions 8.1.0 through 9.3.8 . The flaw exists in the GET entity streamAttachments endpoint because the query path permits complex expressions, allowing an authenticated no...

CVE-2026-46691

The open-source CRM EspoCRM contains an Insecure Direct Object Reference (IDOR) vulnerability in the POST /api/v1/Import/{id}/exportErrors endpoint in versions prior to 9.3.7 . While the endpoint performs a scope-level check, it fails to perform the entity-level ownership check required by the Im...

CVE-2026-46691 EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/id/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that impor...

EUVD-2026-102099

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/id/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that impor...

CVE-2026-46708

The open-source customer relationship management application EspoCRM (prior to version 9.3.7) is vulnerable to an authorization bypass (CWE-639, CWE-862). A low-privileged user with access to a shared TargetList can perform unauthorized opt-out or cancel-opt-out actions on protected Contact or Le...

CVE-2026-46708 EspoCRM: Target list Opt-Out actions allows opting out record without access Target List and access to record

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetList can invoke opt-out or cancel-opt-out actions for a protected Contact or Lead that the user cannot read or edit. The service validates access to the targ...

EUVD-2026-102098

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetList can invoke opt-out or cancel-opt-out actions for a protected Contact or Lead that the user cannot read or edit. The service validates access to the targ...

CVE-2026-47168

The open-source CRM application EspoCRM is vulnerable to Remote Code Execution (RCE) in versions prior to 9.3.7 . An authenticated administrator can exploit unsafe PHP object deserialization by supplying crafted serialized data within MassAction or Export parameters . Because the application fail...

EUVD-2026-102096

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do...