Micropyramid Bottlecrm vulnerabilities

4 CVEs affecting Micropyramid Bottlecrm, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-110595, published 2026-10-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-110594, published 2026-10-14. Medium severity, CVSS 4.9. EPSS: 0.6% chance of exploitation in the next 30 days. BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex…
CVE-2026-110595, published 2026-10-14. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in _read_upload() that reads entire CSV uploads before enforcing the 5 MB limit. Authenticated users with…
CVE-2026-110593, published 2026-10-14. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task, which compiles the user-supplied AccountEmail message_body with…
CVE-2026-110592, published 2026-10-14. Low severity, CVSS 3.5. EPSS: 0.4% chance of exploitation in the next 30 days. BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render_invoice_template() that allows authenticated organization members to inject markup into custom-template invoice PDFs.…