Veille CVE

Jeudi 8 octobre 2026

2 CVE sur 3

Critique 0 Élevée 1 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « espocrm » ✕
  1. CVE-2026-105832 4.3 Moyenne

    espocrm

    EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly.

  2. CVE-2026-105831 4.3 Moyenne

    espocrm

    EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form data. The request body is stored in LeadCaptureLogRecord.data and rendered unescaped when administrators view the log record, though Content Security Policy blocks JavaScript execution.