EspoCRM 7.1.8
Approved changes feed: RSS · Atom
cpe:2.3:a:espocrm:espocrm:7.1.8:*:*:*:*:*:*:*part: a version: 7.1.8 update: *
| Vendor | Espocrm (ff4e2137-64b5-5f10-a0dc-532edbec3cdf) |
|---|---|
| Product | Espocrm (3f6fb336-e6cc-5c15-9f46-86f28ef5a923) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/espocrm/espocrm |
purl2cpe | 2026-06-01 10:15:35.227733 |
pkg:sourceforge/espocrm |
purl2cpe | 2026-06-01 10:15:35.227734 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-38846 |
vulnerable | 2026-06-08 05:47:17.458061 |
Details available
EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel (HTTP). An attacker may capture the cookie from the insecure channel using MITM attack.
Published: 2022-09-16T13:15:24.000Z
Updated: 2024-08-03T11:02:14.673Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-38845 |
vulnerable | 2026-06-08 05:47:17.457698 |
Details available
Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file containing malicious JavaScript to authenticated user. Any authenticated user importing the crafted CSV file may end up running the malicious JavaScripting in the browser.
Published: 2022-09-16T13:24:36.000Z
Updated: 2024-08-03T11:02:14.615Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-38844 |
vulnerable | 2026-06-08 05:47:17.457419 |
Details available
CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands. Admin user exporting contacts in CSV file may end up executing the malicious system commands on his system.
Published: 2022-09-16T13:25:42.000Z
Updated: 2024-08-03T11:02:14.669Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-38843 |
vulnerable | 2026-06-08 05:47:17.457047 |
Details available
EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server. Attacker may execute these malicious files to run unintended code on the server to compromise the server.
Published: 2022-09-16T13:26:44.000Z
Updated: 2024-08-03T11:02:14.570Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.