CVE-2026-59994

The open source CRM application EspoCRM is vulnerable to a pre-authentication stored HTML injection in versions prior to 9.3.9 . An unauthenticated remote attacker can send an email to a monitored group, IMAP address, or email-to-Case address containing arbitrary HTML in the plain-text body. Espo...