CVE-2026-53574

CVE-2026-53574 · EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injection can extract arbitrary database information, including active administrator session tokens, and can enable full privilege escalation. This issue is fixed in version 9.3.8.

CVSS 7.6 · Élevée · EPSS 0,2%

Publication

2026-10-15T14:45:52.943Z

Mise à jour

2026-10-15T15:33:36.150Z

Vérifiez votre serveur →