MEDIUM 5.3 NVD
CVE-2026-105831
EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture pub
EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form data. The request body is stored in LeadCaptureLogRecord.data and rendered unescaped when administrators view the log record, though Content Security Policy blocks JavaScript execution.
References
- https://github.com/espocrm/espocrm/security/advisories/GHSA-xfqv-j65r-qqgh
- https://www.vulncheck.com/advisories/espocrm-before-10.0.6-unauthenticated-stored-html-inj
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-08 via NVD.
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.