{"schema_version":1,"title":"Espocrm vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 11 vulnerabilities in Espocrm: 0 in the last 7 days and 3 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-92298, was published on 16 September 2026. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/espocrm","json_url":"https://junglewise.ai/threats/vendors/espocrm.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/espocrm","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":1,"all_time":11,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":3,"last_90_days":3,"last_365_days":11},"latest":[{"cve":"CVE-2026-92298","cvss":4.8,"epss":0.0043,"slug":"cve-2026-92298-espocrm-weak-random-token-generation-for-opt-in-and-invitations","title":"EspoCRM weak random token generation for opt-in and invitations","severity":"medium","exploited":false,"published_at":"2026-09-16T02:17:39.17+00:00","url":"https://junglewise.ai/threats/cve-2026-92298-espocrm-weak-random-token-generation-for-opt-in-and-invitations"},{"cve":"CVE-2026-90934","cvss":4.3,"epss":0.0031,"slug":"cve-2026-90934-espocrm-field-level-security-bypass-in-attendees-endpoints","title":"EspoCRM field-level security bypass in attendees endpoints","severity":"medium","exploited":false,"published_at":"2026-09-14T13:19:31.83+00:00","url":"https://junglewise.ai/threats/cve-2026-90934-espocrm-field-level-security-bypass-in-attendees-endpoints"},{"cve":"CVE-2026-88896","cvss":5.3,"epss":0.0037,"slug":"cve-2026-88896-espocrm-server-side-request-forgery-via-ipv6-transition-address","title":"EspoCRM server-side request forgery via IPv6 transition address bypass","severity":"medium","exploited":false,"published_at":"2026-09-10T14:17:19.05+00:00","url":"https://junglewise.ai/threats/cve-2026-88896-espocrm-server-side-request-forgery-via-ipv6-transition-address"},{"cve":"CVE-2026-41160","cvss":4.3,"slug":"cve-2026-41160-espocrm-broken-access-control-in-note-pinning-api","title":"EspoCRM broken access control in Note Pinning API","severity":"medium","exploited":false,"published_at":"2026-05-28T17:16:22.053+00:00","url":"https://junglewise.ai/threats/cve-2026-41160-espocrm-broken-access-control-in-note-pinning-api"},{"cve":"CVE-2026-41141","cvss":6.5,"slug":"cve-2026-41141-espocrm-idor-in-emailtemplate-endpoint-leaks-entity-data","title":"EspoCRM IDOR in EmailTemplate endpoint leaks entity data","severity":"medium","exploited":false,"published_at":"2026-05-28T17:16:21.81+00:00","url":"https://junglewise.ai/threats/cve-2026-41141-espocrm-idor-in-emailtemplate-endpoint-leaks-entity-data"},{"cve":"CVE-2026-33741","cvss":6.8,"slug":"cve-2026-33741-espocrm-stored-xss-via-svg-and-javascript-attachments","title":"EspoCRM stored XSS via SVG and JavaScript attachments","severity":"medium","exploited":false,"published_at":"2026-05-19T19:16:49.463+00:00","url":"https://junglewise.ai/threats/cve-2026-33741-espocrm-stored-xss-via-svg-and-javascript-attachments"},{"cve":"CVE-2026-33740","cvss":5.4,"slug":"cve-2026-33740-espocrm-idor-in-email-importeml-endpoint","title":"EspoCRM IDOR in Email importEml endpoint","severity":"medium","exploited":false,"published_at":"2026-04-13T21:16:25.007+00:00","url":"https://junglewise.ai/threats/cve-2026-33740-espocrm-idor-in-email-importeml-endpoint"},{"cve":"CVE-2026-33659","cvss":3.5,"slug":"cve-2026-33659-espocrm-ssrf-via-dns-rebinding-in-attachment-fromimageurl","title":"EspoCRM SSRF via DNS rebinding in Attachment fromImageUrl","severity":"low","exploited":false,"published_at":"2026-04-13T21:16:24.76+00:00","url":"https://junglewise.ai/threats/cve-2026-33659-espocrm-ssrf-via-dns-rebinding-in-attachment-fromimageurl"},{"cve":"CVE-2026-33657","cvss":4.6,"slug":"cve-2026-33657-espocrm-stored-html-injection-in-email-notifications","title":"EspoCRM stored HTML injection in email notifications","severity":"medium","exploited":false,"published_at":"2026-04-13T20:16:34.143+00:00","url":"https://junglewise.ai/threats/cve-2026-33657-espocrm-stored-html-injection-in-email-notifications"},{"cve":"CVE-2026-33534","cvss":4.3,"slug":"cve-2026-33534-espocrm-ssrf-via-internal-host-validation-bypass-in-attachment","title":"EspoCRM SSRF via internal-host validation bypass in Attachment API","severity":"medium","exploited":false,"published_at":"2026-04-13T20:16:33.97+00:00","url":"https://junglewise.ai/threats/cve-2026-33534-espocrm-ssrf-via-internal-host-validation-bypass-in-attachment"},{"cve":"CVE-2020-37094","cvss":8.1,"epss":0.0055,"slug":"cve-2020-37094-espocrm-2fa-bypass-via-authentication-token-reuse","title":"EspoCRM 2FA bypass via authentication token reuse","severity":"high","exploited":false,"published_at":"2026-02-03T22:16:25.673+00:00","url":"https://junglewise.ai/threats/cve-2020-37094-espocrm-2fa-bypass-via-authentication-token-reuse"}],"vendor":{"hub":true,"name":"Espocrm","slug":"espocrm","homepage":"https://www.espocrm.com/","description":"EspoCRM is an open-source customer relationship management software provider.","url":"https://junglewise.ai/threats/vendors/espocrm"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2020-37094","cvss":8.1,"epss":0.0055,"slug":"cve-2020-37094-espocrm-2fa-bypass-via-authentication-token-reuse","title":"EspoCRM 2FA bypass via authentication token reuse","severity":"high","exploited":false,"published_at":"2026-02-03T22:16:25.673+00:00","url":"https://junglewise.ai/threats/cve-2020-37094-espocrm-2fa-bypass-via-authentication-token-reuse"},{"cve":"CVE-2026-33741","cvss":6.8,"slug":"cve-2026-33741-espocrm-stored-xss-via-svg-and-javascript-attachments","title":"EspoCRM stored XSS via SVG and JavaScript attachments","severity":"medium","exploited":false,"published_at":"2026-05-19T19:16:49.463+00:00","url":"https://junglewise.ai/threats/cve-2026-33741-espocrm-stored-xss-via-svg-and-javascript-attachments"},{"cve":"CVE-2026-41141","cvss":6.5,"slug":"cve-2026-41141-espocrm-idor-in-emailtemplate-endpoint-leaks-entity-data","title":"EspoCRM IDOR in EmailTemplate endpoint leaks entity data","severity":"medium","exploited":false,"published_at":"2026-05-28T17:16:21.81+00:00","url":"https://junglewise.ai/threats/cve-2026-41141-espocrm-idor-in-emailtemplate-endpoint-leaks-entity-data"},{"cve":"CVE-2026-33740","cvss":5.4,"slug":"cve-2026-33740-espocrm-idor-in-email-importeml-endpoint","title":"EspoCRM IDOR in Email importEml endpoint","severity":"medium","exploited":false,"published_at":"2026-04-13T21:16:25.007+00:00","url":"https://junglewise.ai/threats/cve-2026-33740-espocrm-idor-in-email-importeml-endpoint"},{"cve":"CVE-2026-88896","cvss":5.3,"epss":0.0037,"slug":"cve-2026-88896-espocrm-server-side-request-forgery-via-ipv6-transition-address","title":"EspoCRM server-side request forgery via IPv6 transition address bypass","severity":"medium","exploited":false,"published_at":"2026-09-10T14:17:19.05+00:00","url":"https://junglewise.ai/threats/cve-2026-88896-espocrm-server-side-request-forgery-via-ipv6-transition-address"},{"cve":"CVE-2026-92298","cvss":4.8,"epss":0.0043,"slug":"cve-2026-92298-espocrm-weak-random-token-generation-for-opt-in-and-invitations","title":"EspoCRM weak random token generation for opt-in and invitations","severity":"medium","exploited":false,"published_at":"2026-09-16T02:17:39.17+00:00","url":"https://junglewise.ai/threats/cve-2026-92298-espocrm-weak-random-token-generation-for-opt-in-and-invitations"},{"cve":"CVE-2026-33657","cvss":4.6,"slug":"cve-2026-33657-espocrm-stored-html-injection-in-email-notifications","title":"EspoCRM stored HTML injection in email notifications","severity":"medium","exploited":false,"published_at":"2026-04-13T20:16:34.143+00:00","url":"https://junglewise.ai/threats/cve-2026-33657-espocrm-stored-html-injection-in-email-notifications"},{"cve":"CVE-2026-90934","cvss":4.3,"epss":0.0031,"slug":"cve-2026-90934-espocrm-field-level-security-bypass-in-attendees-endpoints","title":"EspoCRM field-level security bypass in attendees endpoints","severity":"medium","exploited":false,"published_at":"2026-09-14T13:19:31.83+00:00","url":"https://junglewise.ai/threats/cve-2026-90934-espocrm-field-level-security-bypass-in-attendees-endpoints"},{"cve":"CVE-2026-41160","cvss":4.3,"slug":"cve-2026-41160-espocrm-broken-access-control-in-note-pinning-api","title":"EspoCRM broken access control in Note Pinning API","severity":"medium","exploited":false,"published_at":"2026-05-28T17:16:22.053+00:00","url":"https://junglewise.ai/threats/cve-2026-41160-espocrm-broken-access-control-in-note-pinning-api"},{"cve":"CVE-2026-33534","cvss":4.3,"slug":"cve-2026-33534-espocrm-ssrf-via-internal-host-validation-bypass-in-attachment","title":"EspoCRM SSRF via internal-host validation bypass in Attachment API","severity":"medium","exploited":false,"published_at":"2026-04-13T20:16:33.97+00:00","url":"https://junglewise.ai/threats/cve-2026-33534-espocrm-ssrf-via-internal-host-validation-bypass-in-attachment"}],"generated_at":"2026-09-26T09:11:00.170868+00:00","technologies":[{"name":"EspoCRM","slug":"espocrm","vulnerabilities":11,"url":"https://junglewise.ai/threats/technologies/espocrm"}]}