Cross site scripting

An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed on the Preference page as well as while sending an email when a malicious payload was inserted inside the Email Signature in the Preference page. The attacker could insert malicious JavaScript inside his email signature, whi...

Design/Logic Flaw

An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed inside the title and breadcrumb of a newly formed entity available to all the users. A malicious user can inject JavaScript in these values of an entity, thus stealing user cookies when someone visits the publicly accessible...

Cross site scripting

An issue was discovered in EspoCRM before 5.6.9. Stored XSS in the body of an Article was executed when a victim opens articles received through mail. This Article can be formed by an attacker using the Knowledge Base feature in the tab list. The attacker could inject malicious JavaScript inside...

CVE-2019-14547

An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a attacker sends an attachment to admin with malicious JavaScript in the filename. This JavaScript executed when an admin selects the particular file from the list of all attachments. The attacker could inject the...

CVE-2019-14547

CVE-2019-14547 affects EspoCRM up to version 5.6.8. The issue is a stored XSS where an attacker can send an attachment with a malicious JavaScript-in-filename that executes when an admin selects that file from the attachments list, potentially exposing cookies or compromising accounts. Public sou...

CVE-2019-14548

EspoCRM before version 5.6.9 is affected by a stored XSS vulnerability in the body of an Article. The issue can be triggered when victims open articles received via mail; an attacker can form the Article using the Knowledge Base feature and inject malicious JavaScript, potentially stealing cookie...

CVE-2019-14548

An issue was discovered in EspoCRM before 5.6.9. Stored XSS in the body of an Article was executed when a victim opens articles received through mail. This Article can be formed by an attacker using the Knowledge Base feature in the tab list. The attacker could inject malicious JavaScript inside...

CVE-2019-14546

Affected software: EspoCRM before 5.6.9. Vulnerability: Stored XSS on the Preference page and in emails via a malicious Email Signature. Root cause (as described): improper handling of content in the Email Signature that allows JavaScript to execute when the recipient replies or forwards, enablin...

CVE-2019-14546

An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed on the Preference page as well as while sending an email when a malicious payload was inserted inside the Email Signature in the Preference page. The attacker could insert malicious JavaScript inside his email signature, whi...

CVE-2019-14550

EspoCRM before 5.6.9 is affected by a Stored XSS vulnerability. An attacker can inject malicious JavaScript via the add tab list feature, which executes when a victim clicks Edit Dashboard on the Homepage, enabling cookie theft and account compromise. A fix is available in version 5.6.9 (see link...

CVE-2019-14550

An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a victim clicks on the Edit Dashboard feature present on the Homepage. An attacker can load malicious JavaScript inside the add tab list feature, which would fire when a user clicks on the Edit Dashboard button, thus...

CVE-2019-14549

EspoCRM prior to v5.6.9 is affected by a stored XSS vulnerability in the title and breadcrumb of newly created entities, potentially stealing cookies when a public link is visited. The underlying issue allows injection of JavaScript by a malicious user into those fields. A fix is available in the...

CVE-2019-14549

An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed inside the title and breadcrumb of a newly formed entity available to all the users. A malicious user can inject JavaScript in these values of an entity, thus stealing user cookies when someone visits the publicly accessible...

EspoCRM Cross-Site Scripting Vulnerability (CNVD-2019-24797)

EspoCRM is an open source web-based customer relationship management CRM system. The system provides features such as sales automation, community and customer support. A cross-site scripting vulnerability exists in EspoCRM versions prior to 5.6.6. The vulnerability stems from the WEB application...

EspoCRM cross-site scripting vulnerability (CNVD-2019-24798)

EspoCRM is an open source web-based customer relationship management CRM system. The system provides features such as sales automation, community and customer support. A cross-site scripting vulnerability exists in EspoCRM versions prior to 5.6.6. The vulnerability stems from the WEB application...

EspoCRM cross-site scripting vulnerability (CNVD-2019-24799)

EspoCRM is an open source web-based customer relationship management CRM system. The system provides features such as sales automation, community and customer support. A cross-site scripting vulnerability exists in EspoCRM versions prior to 5.6.6. The vulnerability stems from the WEB application...

EspoCRM Cross-Site Scripting Vulnerability (CNVD-2019-24801)

EspoCRM is an open source web-based customer relationship management CRM system. The system provides features such as sales automation, community and customer support. A cross-site scripting vulnerability exists in EspoCRM version 5.6.4. The vulnerability stems from the WEB application lacking...

EspoCRM Cross-Site Scripting Vulnerability (CNVD-2019-24800)

EspoCRM is an open source web-based customer relationship management CRM system. The system provides features such as sales automation, community and customer support. A cross-site scripting vulnerability exists in EspoCRM version 5.6.4. The vulnerability stems from the WEB application lacking...

EspoCRM Trust Management Issue Vulnerabilities

EspoCRM is an open source web-based customer relationship management CRM system. The system provides features such as sales automation, community and customer support. EspoCRM is vulnerable to a trust management issue. An attacker can exploit this vulnerability to brute-force break a user's...

CVE-2019-14350

EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base. A malicious attacker can inject JavaScript code in the body parameter during api/v1/KnowledgeBaseArticle knowledge-base record creation...