CVE-2021-3539mediumCWE-79

CVE-2021-3539: medium-severity vulnerability in EspoCRM

EspoCRM Avatar Persistent XSS

Published · Updated

Follow this CVE+ Monitor espocrm

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 0.6%
EspoCRM 6.1.6 and prior suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. This issue was fixed in version 6.1.7 of the product.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
Affected products
EspoCRM · EspoCRM
Related CVEs — EspoCRM

In the same product, most dangerous first.

CVE-2023-5966MEDIUMUnrestricted Upload of File with Dangerous Type in EspoCRMEPSS 1.0%CVE-2023-5965MEDIUMUnrestricted Upload of File with Dangerous Type in EspoCRMEPSS 1.0%CVE-2020-37094HIGHEspoCRM 5.7.0 < 5.9.0 - Two-Factor Authentication Bypass via Auth Token Reuse Between Accounts with Identical PasswordsEPSS 0.5%CVE-2026-92298MEDIUMEspoCRM through 10.0.8 Weak Token Generation via rand()EPSS 0.4%