CVE-2019-14549: Espocrm

Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days.

An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed inside the title and breadcrumb of a newly formed entity available to all the users. A malicious user can inject JavaScript in these values of an entity, thus stealing user cookies when someone visits the publicly accessible link.

Affected products

• Espocrm Espocrm: before 5.6.9 (fixed in 5.6.9)

Published 2019-08-05. Last modified 2026-06-17.