espocrm
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 50 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from October 20, 2014 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes
EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwords
EspoCRM before 10.0.6 Unauthenticated Stored HTML Injection via Lead Capture Form
EspoCRM through 10.0.8 Weak Token Generation via rand()
EspoCRM before 10.0.4 Field-level Security Bypass via Attendees
EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass
EspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity Data via Email Address Lookup
EspoCRM: Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of notes
EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript
EspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and delete
Monitor espocrm in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.