en
EspoCRM is an open-source customer relationship management application and business application platform. It helps organizations manage contacts, accounts, projects, opportunities, sales processes, and related records. The software can be self-hosted or delivered through cloud hosting and is intended for organizations seeking a customizable CRM.
As of 09/14/2026, espocrm recorded 2 security vulnerabilities in the last 90 days across 1 products, including 1 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, espocrm had the most security vulnerabilities in the espocrm ecosystem, with 2 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-88896EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass | Exploitation statusNot confirmed | FixYes | Affected productespocrm | Published09/10/2026 | SeverityMedium |
CVE-2026-41141EspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity Data via Email Address Lookup | Exploitation statusPublic exploit | FixYes | Affected productespocrm | Published05/28/2026 | SeverityMedium |
CVE-2026-41160EspoCRM: Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of notes | Exploitation statusPublic exploit | FixYes | Affected productespocrm | Published05/28/2026 | SeverityMedium |
CVE-2026-33741EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript | Exploitation statusPublic exploit | FixYes | Affected productespocrm | Published05/19/2026 | SeverityMedium |
CVE-2026-33733EspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and delete | Exploitation statusPublic exploit | FixNot confirmed | Affected productespocrm | Published04/22/2026 | SeverityHigh |
CVE-2026-33656EspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment `sourceId`, exploitable by admin user | Exploitation statusPublic exploit | FixNot confirmed | Affected productespocrm | Published04/22/2026 | SeverityCritical |
CVE-2026-33740EspoCRM: Email importEml can import and delete another user's attachment by raw fileId | Exploitation statusPublic exploit | FixYes | Affected productespocrm | Published04/13/2026 | SeverityMedium |
CVE-2026-33659EspoCRM: SSRF via DNS Rebinding in Attachment fromImageUrl Endpoint Allows Internal Network Access | Exploitation statusPublic exploit | FixYes | Affected productespocrm | Published04/13/2026 | SeverityLow |
CVE-2026-33657EspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field | Exploitation statusPublic exploit | FixYes | Affected productespocrm | Published04/13/2026 | SeverityMedium |
CVE-2026-33534EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation | Exploitation statusPublic exploit | FixYes | Affected productespocrm | Published04/13/2026 | SeverityMedium |
CVE-2020-37094EspoCRM 5.7.0 < 5.9.0 - Two-Factor Authentication Bypass via Auth Token Reuse Between Accounts with Identical Passwords | Exploitation statusPublic exploit | FixYes | Affected productespocrm | Published02/03/2026 | SeverityHigh |
CVE-2025-59428EspoCRM allows arbitrary user creation via stored SVG injection and CSRF | Exploitation statusPublic exploit | FixYes | Affected productespocrm | Published10/14/2025 | SeverityMedium |
CVE-2025-52892EspoCRM is vulnerable to access denial through double slash in URI corrupting router cache | Exploitation statusNot known exploited | FixYes | Affected productespocrm | Published08/05/2025 | SeverityMedium |
CVE-2025-52575EspoCRM vulnerable to LDAP Injection through Improper Neutralization of Special Elements | Exploitation statusPublic exploit | FixYes | Affected productespocrm | Published07/21/2025 | SeverityMedium |
CVE-2025-32390EspoCRM vulnerable to HTML Injection into phishing, which may lead to account takeover | Exploitation statusPublic exploit | FixNot confirmed | Affected productespocrm | Published05/12/2025 | SeverityHigh |
CVE-2025-32789EspoCRM Allows Potential Disclosure of Sensitive Information in the User Sorting Function | Exploitation statusPublic exploit | FixYes | Affected productespocrm | Published04/16/2025 | SeverityLow |
CVE-2025-32385EspoCRM allows unrestricted Embedding in Iframe dashlet | Exploitation statusNot known exploited | FixYes | Affected productespocrm | Published04/15/2025 | SeverityMedium |
CVE-2024-24818EspoCRM weakness in "Forgot password" | Exploitation statusPublic exploit | FixYes | Affected productespocrm | Published02/29/2024 | SeverityMedium |
CVE-2023-46736Server-Side Request Forgery in espocrm | Exploitation statusNot confirmed | FixNot confirmed | Affected productespocrm | Published12/05/2023 | SeverityMedium |
CVE-2023-5966Unrestricted Upload of File with Dangerous Type in EspoCRM | Exploitation statusNot known exploited | FixYes | Affected productespocrm | Published11/30/2023 | SeverityMedium |
CVE-2023-5965Unrestricted Upload of File with Dangerous Type in EspoCRM | Exploitation statusNot known exploited | FixYes | Affected productespocrm | Published11/30/2023 | SeverityMedium |
CVE-2022-38843 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/16/2022 | SeverityUnknown |
CVE-2022-38844 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/16/2022 | SeverityUnknown |
CVE-2022-38845 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/16/2022 | SeverityUnknown |
CVE-2022-38846 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/16/2022 | SeverityUnknown |
CVE-2021-3539EspoCRM Avatar Persistent XSS | Exploitation statusNot confirmed | FixYes | Affected productespocrm | Published08/04/2021 | SeverityMedium |
CVE-2019-14547 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/05/2019 | SeverityUnknown |
CVE-2019-14548 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/05/2019 | SeverityUnknown |
CVE-2019-14546 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/05/2019 | SeverityUnknown |
CVE-2019-14550 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/05/2019 | SeverityUnknown |
CVE-2019-14549 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/05/2019 | SeverityUnknown |
CVE-2019-14351 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/28/2019 | SeverityUnknown |
CVE-2019-14350 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/28/2019 | SeverityUnknown |
CVE-2019-14349 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/28/2019 | SeverityUnknown |
CVE-2019-14331 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/28/2019 | SeverityUnknown |
CVE-2019-14330 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/28/2019 | SeverityUnknown |
CVE-2019-14329 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/28/2019 | SeverityUnknown |
CVE-2019-13643 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/18/2019 | SeverityUnknown |
CVE-2018-17301 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/21/2018 | SeverityUnknown |
CVE-2018-17302 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/21/2018 | SeverityUnknown |
CVE-2014-7987 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/31/2014 | SeverityUnknown |
CVE-2014-7986 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/31/2014 | SeverityUnknown |
CVE-2014-7985 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/31/2014 | SeverityUnknown |
CVE-2014-8330 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/20/2014 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
