CVE-2021-3539: Espocrm

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

EspoCRM 6.1.6 and prior suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. This issue was fixed in version 6.1.7 of the product.

Affected products

• Espocrm Espocrm: up to and including 6.1.6

Published 2021-08-04. Last modified 2026-06-17.