EspoCRM 5.6.4
Approved changes feed: RSS · Atom
cpe:2.3:a:espocrm:espocrm:5.6.4:*:*:*:*:*:*:*part: a version: 5.6.4 update: *
| Vendor | Espocrm (ff4e2137-64b5-5f10-a0dc-532edbec3cdf) |
|---|---|
| Product | Espocrm (3f6fb336-e6cc-5c15-9f46-86f28ef5a923) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/espocrm/espocrm |
purl2cpe | 2026-06-01 10:15:35.227527 |
pkg:sourceforge/espocrm |
purl2cpe | 2026-06-01 10:15:35.227528 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2019-14351 |
vulnerable | 2026-06-08 05:12:54.601441 |
Details available
EspoCRM 5.6.4 is vulnerable to user password hash enumeration. A malicious authenticated attacker can brute-force a user password hash by 1 symbol at a time using specially crafted api/v1/User?filterList filters.
Published: 2019-07-28T15:27:05.000Z
Updated: 2024-08-05T00:12:43.463Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-14350 |
vulnerable | 2026-06-08 05:12:54.601134 |
Details available
EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base. A malicious attacker can inject JavaScript code in the body parameter during api/v1/KnowledgeBaseArticle knowledge-base record creation.
Published: 2019-07-28T15:26:58.000Z
Updated: 2024-08-05T00:12:43.400Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-14349 |
vulnerable | 2026-06-08 05:12:54.600746 |
Details available
EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab. An attacker can upload a crafted file that contains JavaScript code in its name. This code will be executed when a user opens a page of any profile with this.
Published: 2019-07-28T15:26:51.000Z
Updated: 2024-08-05T00:12:43.288Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.