- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 40
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
13 assets you may test, 6 excluded.
Web 1
- https://www.espocrm.com
Products and areas 12
- Attachments and the document management surface, both upload and retrieval
- Authentication and session handling, including two-factor methods, LDAP and any single sign-on option in the open-source tree
- Entity Manager and the administration panel, where an administrator defines new entity types, fields and layouts at runtime
- Formula scripts and workflow, where stored configuration becomes executable behaviour on record save
- The access control layer in full: roles, scope-level and field-level permissions, record ownership, teams and the assignment rules that decide who sees a record
- The core entity set a real deployment runs on, covering accounts, contacts, leads, opportunities, cases, documents and activities
- The email integration, both inbound accounts the server polls and outbound sending, plus the rendering of received mail in the interface
- The import and export tooling, which parses user-supplied spreadsheet data and writes records from it
- The policy takes private reports through GitHub or the vendor's contact channels and publishes a list of report types it will not accept. Outside that list it draws no component boundary, so the whole EspoCRM application is in scope
- The portal, the low-privilege external surface where a customer signs in to see their own cases and documents
- The reporting and list-view layer, where user-supplied filters and search parameters drive database queries
- The REST API and the API key and HMAC authentication a scripted consumer uses
Out of scope (6)
- A role or field-level permission an administrator granted deliberately
- Copy-pasted model output submitted without a verified reproduction, which the policy rules out by name
- Hosting and server configuration, including a deployment that serves the data directory over HTTP
- Paid extensions and third-party modules distributed outside the open-source repository
- Report types on the policy's published non-accepted list, which the vendor maintains independently of this page
- Upstream PHP dependency issues, unless EspoCRM's own use of the dependency is what makes the defect reachable
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Report through GitHub private vulnerability reporting on espocrm/espocrm, which is enabled, or through the vendor contact form the policy links
-
The policy publishes a list of report types it does not accept. Read it before filing so your report is not closed on arrival
-
The policy warns explicitly against copy-pasted LLM output. Send a working reproduction against a current release, not a model's summary of a scanner result
-
Give the exact version, the role your test user held and which entity types were involved. EspoCRM's authorisation is per-entity and per-role, so a report without that cannot be reproduced
-
Say whether the reproduction needs any of the vendor's paid extensions, which live outside the open-source repository
-
There is no reward tier and no payment to negotiate
Not accepted
-
Report types on the policy's published non-accepted list
-
Paid extensions and third-party modules distributed outside the open-source repository
-
Upstream PHP dependency issues, unless EspoCRM's own use of the dependency is what makes the defect reachable
-
Hosting and server configuration, including a deployment that serves the data directory over HTTP
-
A role or field-level permission an administrator granted deliberately
-
Copy-pasted model output submitted without a verified reproduction
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-33733 | EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template management endpoints accept attacker-controlled `name` and `scope` values and pass them into template path construction without normalization or traversal filtering. As a result, an authenticated admin can use `../` sequences to escape the intended template directory and read, create, | High 7.2 | 22 Apr 2026 |
| CVE-2026-33656 | EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formula scripting engine allowing updating attachment's sourceId thus allowing an authenticated admin to overwrite the `sourceId` field on `Attachment` entities. Because `sourceId` is concatenated directly into a file path with no sanitization in `EspoUploadDir::getFilePath()`, an att | Critical 9.1 | 22 Apr 2026 |
| CVE-2026-33659 | EspoCRM is an open source customer relationship management application. In versions 9.3.3 and below, the POST /api/v1/Attachment/fromImageUrl endpoint is vulnerable to Server-Side Request Forgery (SSRF) via a DNS rebinding (TOCTOU) condition. Host validation uses dns_get_record() but the actual HTTP request resolves hostnames through curl's internal resolver (gethostbyname()), allowing the two loo | Low 3.5 | 13 Apr 2026 |
| CVE-2026-33740 | EspoCRM is an open source customer relationship management application. In versions 9.3.3 and below, the POST /api/v1/Email/importEml endpoint contains an Insecure Direct Object Reference (IDOR) vulnerability where the attacker-supplied fileId parameter is used to fetch any attachment directly from the repository without verifying that the current user has authorization to access it. Any authentic | Medium 5.4 | 13 Apr 2026 |
| CVE-2026-33534 | EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have an authenticated Server-Side Request Forgery (SSRF) vulnerability that allows bypassing the internal-host validation logic by using alternative IPv4 representations such as octal notation (e.g., 0177.0.0.1 instead of 127.0.0.1). This is caused by HostCheck::isNotInternalHost() function relying on | Medium 4.3 | 13 Apr 2026 |
| CVE-2026-33657 | EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have a stored HTML injection vulnerability that allows any authenticated user with standard (non-administrative) privileges to inject arbitrary HTML into system-generated email notifications by crafting malicious content in the post field of stream activity notes. The vulnerability exists because serve | Medium 4.6 | 13 Apr 2026 |
| CVE-2020-37094 | EspoCRM 5.7.0 prior to 5.9.0 contains an authentication token reuse vulnerability that allows authenticated attackers to bypass two-factor authentication by exploiting token-to-password-hash mapping in application/Espo/Core/Utils/Authentication/Espo.php. Attackers can obtain an authentication token for a controlled account and replay it against any victim account sharing the same password, since t | High 8.6 | 3 Feb 2026 |
| CVE-2025-59428 | EspoCRM is an open source customer relationship management application. In versions before 9.1.9, a vulnerability allows arbitrary user creation, including administrative accounts, through a combination of stored SVG injection and lack of CSRF protection. An attacker with Knowledge Base edit permissions can embed a malicious SVG element containing a link in the body field of an article. When an au | Medium 5.4 | 14 Oct 2025 |
| CVE-2025-52892 | EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. In versions 9.1.6 and below, if a user loads Espo in the browser with double slashes (e.g https://domain//#Admin) and the webserver does not strip the double slash, it can cause a corrupted Slim router's cache. This will make the instance unusable until there is a completed reb | Medium 4.5 | 5 Aug 2025 |
| CVE-2025-52575 | EspoCRM is an Open Source CRM (Customer Relationship Management) software. EspoCRM versions 9.1.6 and earlier are vulnerable to blind LDAP Injection when LDAP authentication is enabled. A remote, unauthenticated attacker can manipulate LDAP queries by injecting crafted input containing wildcard characters (e.g., *). This may allow the attacker to bypass authentication controls, enumerate valid use | Medium 6.5 | 21 Jul 2025 |
| CVE-2025-32390 | EspoCRM is a free, open-source customer relationship management platform. Prior to version 9.0.8, HTML Injection in Knowledge Base (KB) articles leads to complete page defacement imitating the login page. Authenticated users with the read knowledge article privilege can browse to the KB article and if they submit their credentials, they get captured in plain text. The vulnerability is allowed by o | High 7.0 | 12 May 2025 |
| CVE-2025-32789 | EspoCRM is an Open Source Customer Relationship Management software. Prior to version 9.0.7, users can be sorted by their password hash. This flaw allows an attacker to make assumptions about the hash values of other users stored in the password column of the user table, based on the results of the sorted list of users. Although unlikely, if an attacker knows the hash value of their password, they | Low 3.1 | 16 Apr 2025 |
| CVE-2025-32385 | EspoCRM is an Open Source Customer Relationship Management software. Prior to 9.0.5, Iframe dashlet allows user to display iframes with arbitrary URLs. As the sandbox attribute is not included in the iframe, the remote page can open popups outside of the iframe, potentially tricking users and creating a phishing risk. The iframe URL is user-defined, so an attacker would need to trick the user into | Medium 5.3 | 16 Apr 2025 |
| CVE-2024-24818 | EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" page and redirect victim to malicious page that could lead to credential stealing or another attack. This vulnerability is fixed in 8.1.2. | Medium 5.9 | 21 Mar 2024 |
| CVE-2023-46736 | EspoCRM is an Open Source CRM (Customer Relationship Management) software. In affected versions there is Server-Side Request Forgery (SSRF) vulnerability via the upload image from url api. Users who have access to `the /Attachment/fromImageUrl` endpoint can specify URL to point to an internal host. Even though there is check for content type, it can be bypassed by redirects in some cases. This SSR | Medium 5.3 | 5 Dec 2023 |
| CVE-2023-5965 | An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbitrary PHP code execution. | Medium 4.7 | 30 Nov 2023 |
| CVE-2023-5966 | An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the extension deployment form, which could lead to arbitrary PHP code execution. | Medium 4.7 | 30 Nov 2023 |
| CVE-2022-38843 | EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server. Attacker may execute these malicious files to run unintended code on the server to compromise the server. | High 8.8 | 16 Sep 2022 |
| CVE-2022-38844 | CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands. Admin user exporting contacts in CSV file may end up executing the malicious system commands on his system. | High 8.0 | 16 Sep 2022 |
| CVE-2022-38845 | Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file containing malicious JavaScript to authenticated user. Any authenticated user importing the crafted CSV file may end up running the malicious JavaScripting in the browser. | Medium 6.1 | 16 Sep 2022 |
| CVE-2022-38846 | EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel (HTTP). An attacker may capture the cookie from the insecure channel using MITM attack. | Medium 5.9 | 16 Sep 2022 |
| CVE-2021-3539 | EspoCRM 6.1.6 and prior suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. This issue was fixed in version 6.1.7 of the product. | Medium 6.3 | 4 Aug 2021 |
| CVE-2019-14549 | An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed inside the title and breadcrumb of a newly formed entity available to all the users. A malicious user can inject JavaScript in these values of an entity, thus stealing user cookies when someone visits the publicly accessible link. | Medium 5.4 | 5 Aug 2019 |
| CVE-2019-14550 | An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a victim clicks on the Edit Dashboard feature present on the Homepage. An attacker can load malicious JavaScript inside the add tab list feature, which would fire when a user clicks on the Edit Dashboard button, thus helping him steal victims' cookies (hence compromising their accounts). | Medium 5.4 | 5 Aug 2019 |
| CVE-2019-14546 | An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed on the Preference page as well as while sending an email when a malicious payload was inserted inside the Email Signature in the Preference page. The attacker could insert malicious JavaScript inside his email signature, which fires when the victim replies or forwards the mail, thus helping him steal victims' cookies (hence c | Medium 5.4 | 5 Aug 2019 |
| CVE-2019-14547 | An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a attacker sends an attachment to admin with malicious JavaScript in the filename. This JavaScript executed when an admin selects the particular file from the list of all attachments. The attacker could inject the JavaScript inside the filename and send it to users, thus helping him steal victims' cookies (hence compromi | Medium 5.4 | 5 Aug 2019 |
| CVE-2019-14548 | An issue was discovered in EspoCRM before 5.6.9. Stored XSS in the body of an Article was executed when a victim opens articles received through mail. This Article can be formed by an attacker using the Knowledge Base feature in the tab list. The attacker could inject malicious JavaScript inside the body of the article, thus helping him steal victims' cookies (hence compromising their accounts). | Medium 5.4 | 5 Aug 2019 |
| CVE-2019-14349 | EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab. An attacker can upload a crafted file that contains JavaScript code in its name. This code will be executed when a user opens a page of any profile with this. | Medium 6.1 | 28 Jul 2019 |
| CVE-2019-14350 | EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base. A malicious attacker can inject JavaScript code in the body parameter during api/v1/KnowledgeBaseArticle knowledge-base record creation. | Medium 6.1 | 28 Jul 2019 |
| CVE-2019-14351 | EspoCRM 5.6.4 is vulnerable to user password hash enumeration. A malicious authenticated attacker can brute-force a user password hash by 1 symbol at a time using specially crafted api/v1/User?filterList filters. | High 8.8 | 28 Jul 2019 |
| CVE-2019-14329 | An issue was discovered in EspoCRM before 5.6.6. There is stored XSS due to lack of filtration of user-supplied data in Create Task. A malicious attacker can modify the parameter name to contain JavaScript code. | Medium 6.1 | 28 Jul 2019 |
| CVE-2019-14330 | An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create Case. A malicious attacker can modify the firstName and lastName to contain JavaScript code. | Medium 6.1 | 28 Jul 2019 |
| CVE-2019-14331 | An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create User. A malicious attacker can modify the firstName and lastName to contain JavaScript code. | Medium 6.1 | 28 Jul 2019 |
| CVE-2019-13643 | Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. The attack begins by storing a new stream message containing an XSS payload. The stored payload can then be triggered by clicking a malicious link on the Notifications page. | Medium 6.1 | 18 Jul 2019 |
| CVE-2018-17301 | Reflected XSS exists in client/res/templates/global-search/name-field.tpl in EspoCRM 5.3.6 via /#Account in the search panel. | Medium 5.4 | 21 Sep 2018 |
| CVE-2018-17302 | Stored XSS exists in views/fields/wysiwyg.js in EspoCRM 5.3.6 via a /#Email/view saved draft message. | Medium 5.4 | 21 Sep 2018 |
| CVE-2014-7987 | Cross-site scripting (XSS) vulnerability in EspoCRM before 2.6.0 allows remote attackers to inject arbitrary web script or HTML via the desc parameter in an errors action to install/index.php. | Medium 4.3 | 31 Oct 2014 |
| CVE-2014-7985 | Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter to install/index.php. | High 10.0 | 31 Oct 2014 |
| CVE-2014-7986 | install/index.php in EspoCRM before 2.6.0 allows remote attackers to re-install the application via a 1 value in the installProcess parameter. | Medium 5.0 | 31 Oct 2014 |
| CVE-2014-8330 | Cross-site scripting (XSS) vulnerability in EspoCRM allows remote authenticated users to inject arbitrary web script or HTML via the Name field in a new account. | Low 3.5 | 20 Oct 2014 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 21 Last 12 months 27 Lifetime Access control 38 % XSS 24 % Info disclosure 22 % Injection 16 % Latest advisories Loading the feed Overview EspoCRM is a self-hosted CRM used by small and mid-sized businesses that want their customer database on their own server rather than inside somebody else's tenancy. What it holds is the sales pipeline: contacts, accounts, opportunities and the email threads attached to them. For a project of its size the advisory rate is remarkable, twenty-one of its twenty-seven published advisories in the last twelve months, with the most recent landing on the same day this research was verified. Reports go through GitHub private reporting or the vendor contact form, the policy offers nothing in return, and sorona.xyz pays you directly on qualified, reproduced findings. In scope The policy takes private reports through GitHub or the vendor's contact channels and publishes a list of report types it will not accept. Outside that list it draws no component boundary, so the whole EspoCRM application is in scope The access control layer in full: roles, scope-level and field-level permissions, record ownership, teams and the assignment rules that decide who sees a record The core entity set a real deployment runs on, covering accounts, contacts, leads, opportunities, cases, documents and activities Entity Manager and the administration panel, where an administrator defines new entity types, fields and layouts at runtime Formula scripts and workflow, where stored configuration becomes executable behaviour on record save The REST API and the API key and HMAC authentication a scripted consumer uses The email integration, both inbound accounts the server polls and outbound sending, plus the rendering of received mail in the interface The portal, the low-privilege external surface where a customer signs in to see their own cases and documents Attachments and the document management surface, both upload and retrieval Authentication and session handling, including two-factor methods, LDAP and any single sign-on option in the open-source tree The import and export tooling, which parses user-supplied spreadsheet data and writes records from it The reporting and list-view layer, where user-supplied filters and search parameters drive database queries Out of scope Report types on the policy's published non-accepted list, which the vendor maintains independently of this page Paid extensions and third-party modules distributed outside the open-source repository Upstream PHP dependency issues, unless EspoCRM's own use of the dependency is what makes the defect reachable Hosting and server configuration, including a deployment that serves the data directory over HTTP A role or field-level permission an administrator granted deliberately Copy-pasted model output submitted without a verified reproduction, which the policy rules out by name Most-valued findings Access control bypass at any of the three levels this product implements: scope, record ownership and field-level visibility. Field-level leaks matter more here than in most CRMs because sensitive commercial data is routinely hidden by field rather than by record Anything reachable from the portal that returns records belonging to another customer, since the portal user is an external account that already holds valid credentials Privilege escalation from a regular user to an administrator, where administrator includes Entity Manager and formula scripting Formula and workflow evaluation reachable by a non-administrator, or an administrator-only path that ends in server-side code execution Stored cross-site scripting delivered through inbound email or a record field, then rendered in another user's session. Inbound mail is the field in this product that a complete stranger controls Unauthorised download of attachments and documents through an unchecked identifier SQL injection through list-view filters, search parameters or report definitions, where user input reaches the query builder Authentication defects, including two-factor bypass, session fixation and the password reset flow API endpoints that act on an entity without applying the same access checks the web interface applies Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report through GitHub private vulnerability reporting on espocrm/espocrm, which is enabled, or through the vendor contact form the policy links The policy publishes a list of report types it does not accept. Read it before filing so your report is not closed on arrival The policy warns explicitly against copy-pasted LLM output. Send a working reproduction against a current release, not a model's summary of a scanner result Give the exact version, the role your test user held and which entity types were involved. EspoCRM's authorisation is per-entity and per-role, so a report without that cannot be reproduced Say whether the reproduction needs any of the vendor's paid extensions, which live outside the open-source repository There is no reward tier and no payment to negotiate Disclosure Coordinated privately with the vendor and published as a GitHub Security Advisory alongside a patched release. The advisory stream is the busiest signal this project gives off, running at roughly two a month through the last year, so the pipeline is demonstrably attended and the turnaround is visible in the public record. No fixed embargo length is published. Time disclosure to the release that carries the fix, and expect self-hosted operators to lag it. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability