4 matches found
CVE-2026-53574
EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injecti...
CVE-2026-53574 EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression
EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injecti...
EUVD-2026-102101
EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injecti...
CVE-2026-53574
The open-source customer relationship management application EspoCRM is vulnerable to a boolean-based blind SQL injection in versions 8.1.0 through 9.3.8 . The flaw exists in the GET entity streamAttachments endpoint because the query path permits complex expressions, allowing an authenticated no...