Filtered by vendor Espocrm
Subscriptions
Total
26 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2019-14350 | 1 Espocrm | 1 Espocrm | 2019-07-30 | N/A |
| EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base. A malicious attacker can inject JavaScript code in the body parameter during api/v1/KnowledgeBaseArticle knowledge-base record creation. | ||||
| CVE-2019-13643 | 1 Espocrm | 1 Espocrm | 2019-07-23 | N/A |
| Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. The attack begins by storing a new stream message containing an XSS payload. The stored payload can then be triggered by clicking a malicious link on the Notifications page. | ||||
| CVE-2018-17301 | 1 Espocrm | 1 Espocrm | 2019-02-25 | N/A |
| Reflected XSS exists in client/res/templates/global-search/name-field.tpl in EspoCRM 5.3.6 via /#Account in the search panel. | ||||
| CVE-2014-7987 | 1 Espocrm | 1 Espocrm | 2018-10-09 | N/A |
| Cross-site scripting (XSS) vulnerability in EspoCRM before 2.6.0 allows remote attackers to inject arbitrary web script or HTML via the desc parameter in an errors action to install/index.php. | ||||
| CVE-2014-7986 | 1 Espocrm | 1 Espocrm | 2018-10-09 | N/A |
| install/index.php in EspoCRM before 2.6.0 allows remote attackers to re-install the application via a 1 value in the installProcess parameter. | ||||
| CVE-2014-7985 | 1 Espocrm | 1 Espocrm | 2018-10-09 | N/A |
| Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter to install/index.php. | ||||