{"id":"CVE-2019-14548","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-14548","generatedAt":"2026-10-28T20:27:25.172Z","title":"Stored XSS in the body of an Article was executed when a victim opens articles received through mail.","description":"An issue was discovered in EspoCRM before 5.6.9. Stored XSS in the body of an Article was executed when a victim opens articles received through mail. This Article can be formed by an attacker using the Knowledge Base feature in the tab list. The attacker could inject malicious JavaScript inside the body of the article, thus helping him steal victims' cookies (hence compromising their accounts).","published":"2019-08-05T19:15:11.000Z","lastModified":"2026-06-17T02:18:38.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.0","score":5.4,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-79"],"affected":["espocrm/espocrm"],"epss":{"score":0.0108,"percentile":0.6493,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (1.08%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://gauravnarwani.com/publications/cve-2019-14548/","tags":["Exploit","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://github.com/espocrm/espocrm/commit/ffd3f762ce4a8de3b8962f33513e073c55d943b5","tags":["Patch","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://github.com/espocrm/espocrm/issues/1369","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://github.com/espocrm/espocrm/releases/tag/5.6.9","tags":["Release Notes","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://gauravnarwani.com/publications/cve-2019-14548/","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/espocrm/espocrm/commit/ffd3f762ce4a8de3b8962f33513e073c55d943b5","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/espocrm/espocrm/issues/1369","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/espocrm/espocrm/releases/tag/5.6.9","tags":["Release Notes","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-14548","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}