Vulnerabilidades em EspoCRM
43 resultadosAnálise Vexday
EspoCRM apresenta um perfil de risco baixo com 4 vulnerabilidades catalogadas, nenhuma sob exploração ativa conhecida e nenhuma classificada como crítica. A fraqueza dominante (CWE-434 - Upload de arquivo não validado) sugere vulnerabilidades potenciais em validação de entrada, mas a ausência de ataques ativos e a estabilidade recente (zero publicações nos últimos 90 dias) indicam que o risco está controlado.
CVE-2026-33534MEDIUMEspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notationEPSS 2.0%CVE-2023-5965MEDIUMUnrestricted Upload of File with Dangerous Type in EspoCRMEPSS 1.0%CVE-2023-5966MEDIUMUnrestricted Upload of File with Dangerous Type in EspoCRMEPSS 1.0%CVE-2025-52575MEDIUMEspoCRM vulnerable to LDAP Injection through Improper Neutralization of Special ElementsEPSS 0.8%CVE-2024-24818MEDIUMEspoCRM weakness in "Forgot password"EPSS 0.6%CVE-2021-3539MEDIUMEspoCRM Avatar Persistent XSSEPSS 0.6%CVE-2020-37094HIGHEspoCRM 5.7.0 < 5.9.0 - Two-Factor Authentication Bypass via Auth Token Reuse Between Accounts with Identical PasswordsEPSS 0.5%CVE-2026-33656CRITICALEspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment `sourceId`, exploitable by admin userEPSS 0.5%CVE-2026-33733HIGHEspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and deleteEPSS 0.4%CVE-2026-92298MEDIUMEspoCRM through 10.0.8 Weak Token Generation via rand()EPSS 0.4%CVE-2025-32789LOWEspoCRM Allows Potential Disclosure of Sensitive Information in the User Sorting FunctionEPSS 0.4%CVE-2026-47168CRITICALEspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export paramsEPSS 0.4%CVE-2025-32390HIGHEspoCRM vulnerable to HTML Injection into phishing, which may lead to account takeoverEPSS 0.4%CVE-2026-88896MEDIUMEspoCRM before 10.0.4 SSRF via IPv6 Transition Address BypassEPSS 0.4%CVE-2023-46736MEDIUMServer-Side Request Forgery in espocrmEPSS 0.4%CVE-2026-118686HIGHEspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction RegexEPSS 0.3%CVE-2026-41141MEDIUMEspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity Data via Email Address LookupEPSS 0.3%CVE-2026-59994MEDIUMEspoCRM: Pre-authentication stored HTML injection in stream notification emails about email receivedEPSS 0.3%CVE-2026-63130MEDIUMEspoCRM: Admin path traversal in LabelManager (Custom Label saving) allows arbitrary `.json` file read, write and deleteEPSS 0.3%CVE-2026-33659LOWEspoCRM: SSRF via DNS Rebinding in Attachment fromImageUrl Endpoint Allows Internal Network AccessEPSS 0.3%