Vulnerabilidades em EspoCRM
43 resultadosAnálise Vexday
EspoCRM apresenta um perfil de risco baixo com 4 vulnerabilidades catalogadas, nenhuma sob exploração ativa conhecida e nenhuma classificada como crítica. A fraqueza dominante (CWE-434 - Upload de arquivo não validado) sugere vulnerabilidades potenciais em validação de entrada, mas a ausência de ataques ativos e a estabilidade recente (zero publicações nos últimos 90 dias) indicam que o risco está controlado.
CVE-2025-32385MEDIUMEspoCRM allows unrestricted Embedding in Iframe dashletEPSS 0.3%CVE-2026-90934HIGHEspoCRM before 10.0.4 Field-level Security Bypass via AttendeesEPSS 0.3%CVE-2026-75505MEDIUMEspoCRM: Access control bypass in Mass Update letting regular user with Mass Update permission read any attachmentEPSS 0.3%CVE-2026-41160MEDIUMEspoCRM: Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of notesEPSS 0.3%CVE-2025-52892MEDIUMEspoCRM is vulnerable to access denial through double slash in URI corrupting router cacheEPSS 0.3%CVE-2026-105831MEDIUMEspoCRM before 10.0.6 Unauthenticated Stored HTML Injection via Lead Capture FormEPSS 0.3%CVE-2026-105832MEDIUMEspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated RoutesEPSS 0.3%CVE-2026-77460MEDIUMEspoCRM: Mass email template renderer leaks restricted record fieldsEPSS 0.2%CVE-2026-46694MEDIUMEspoCRM: Portal User ACL Bypass Exposes Internal Stream NotesEPSS 0.2%CVE-2026-46691MEDIUMEspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other UsersEPSS 0.2%CVE-2026-53575LOWEspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin userEPSS 0.2%CVE-2026-109959MEDIUMEspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read EndpointEPSS 0.2%CVE-2026-109958MEDIUMEspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book SearchEPSS 0.2%CVE-2026-105833HIGHEspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP PasswordsEPSS 0.2%CVE-2026-33740MEDIUMEspoCRM: Email importEml can import and delete another user's attachment by raw fileIdEPSS 0.2%CVE-2026-33741MEDIUMEspoCRM: Stored XSS via SVG attachment loading same-origin JavaScriptEPSS 0.2%CVE-2026-55154MEDIUMEspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in exportEPSS 0.2%CVE-2026-53574HIGHEspoCRM: Blind SQL injection via streamAttachments where-clause complex expressionEPSS 0.2%CVE-2026-109957MEDIUMEspoCRM before 10.0.7 IDOR via Import attachmentId ParameterEPSS 0.2%CVE-2026-55184LOWEspoCRM: Stored XSS in wysiwyg template fields if CSP is disabledEPSS 0.2%