CVE-2024-24818: fallo de gravedad media en espocrm
EspoCRM weakness in "Forgot password"
Publicada el · Actualizada el
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.9epss 0.6%
probabilidad de explotación
0.6%top 52% de las CVE
explotación observada
noninguna fuente lo reporta
EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" page and redirect victim to malicious page that could lead to credential stealing or another attack. This vulnerability is fixed in 8.1.2.
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
Productos afectados
espocrm · espocrmCVEs relacionadas — espocrm
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-33534MEDIUMEspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notationEPSS 1.7%CVE-2025-52575MEDIUMEspoCRM vulnerable to LDAP Injection through Improper Neutralization of Special ElementsEPSS 0.7%CVE-2026-33733HIGHEspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and deleteEPSS 0.6%CVE-2026-33656CRITICALEspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment `sourceId`, exploitable by admin userEPSS 0.6%CVE-2025-32789LOWEspoCRM Allows Potential Disclosure of Sensitive Information in the User Sorting FunctionEPSS 0.4%CVE-2026-33659LOWEspoCRM: SSRF via DNS Rebinding in Attachment fromImageUrl Endpoint Allows Internal Network AccessEPSS 0.4%