CVE-2026-47168

The open-source CRM application EspoCRM is vulnerable to Remote Code Execution (RCE) in versions prior to 9.3.7 . An authenticated administrator can exploit unsafe PHP object deserialization by supplying crafted serialized data within MassAction or Export parameters . Because the application fail...

EUVD-2026-102096

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do...