CVE-2026-53574: falha de alta gravidade em espocrm
EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression
Publicada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.6epss 0.2%
probabilidade de exploração
0.2%top 89% das CVEs
exploração observada
nãonenhuma fonte reporta
EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injection can extract arbitrary database information, including active administrator session tokens, and can enable full privilege escalation. This issue is fixed in version 9.3.8.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Produtos afetados
espocrm · espocrmCVEs relacionadas — espocrm
No mesmo produto, das mais perigosas para as menos.
CVE-2026-33534MEDIUMEspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notationEPSS 1.7%CVE-2025-52575MEDIUMEspoCRM vulnerable to LDAP Injection through Improper Neutralization of Special ElementsEPSS 0.8%CVE-2024-24818MEDIUMEspoCRM weakness in "Forgot password"EPSS 0.6%CVE-2026-33733HIGHEspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and deleteEPSS 0.6%CVE-2026-33656CRITICALEspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment `sourceId`, exploitable by admin userEPSS 0.6%CVE-2025-32789LOWEspoCRM Allows Potential Disclosure of Sensitive Information in the User Sorting FunctionEPSS 0.4%