CVE-2025-32390: EspoCRM vulnerable to HTML Injection into phishing, which may lead to account takeover
First published: Mon May 12 2025(Updated: )
EspoCRM is a free, open-source customer relationship management platform. Prior to version 9.0.8, HTML Injection in Knowledge Base (KB) articles leads to complete page defacement imitating the login page. Authenticated users with the read knowledge article privilege can browse to the KB article and if they submit their credentials, they get captured in plain text. The vulnerability is allowed by overly permissive HTML editing being allowed on the KB articles. Any authenticated user with the privilege to read KB articles is impacted. In an enterprise with multiple applications, the malicious KB article could be edited to match the login pages of other applications, which would make it useful for credential harvesting against other applications as well. Version 9.0.8 contains a patch for the issue.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| EspoCRM | <9.0.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-32390?
CVE-2025-32390 is classified as a medium severity vulnerability due to the risk of HTML Injection leading to page defacement.
How do I fix CVE-2025-32390?
To fix CVE-2025-32390, upgrade your EspoCRM to version 9.0.8 or later, which addresses this vulnerability.
Which versions of EspoCRM are affected by CVE-2025-32390?
CVE-2025-32390 affects all versions of EspoCRM prior to version 9.0.8.
What type of vulnerability is CVE-2025-32390?
CVE-2025-32390 is an HTML Injection vulnerability found in the Knowledge Base articles of EspoCRM.
Who can exploit CVE-2025-32390?
Authenticated users with the read knowledge article privilege can exploit CVE-2025-32390 to perform HTML Injection.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/severity
- agent/last-modified-date
- agent/source
- agent/tags
- agent/author
- agent/event
- vendor/espocrm
- canonical/espocrm