{"id":"CVE-2026-105831","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-105831","generatedAt":"2026-10-27T22:47:42.054Z","title":"EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form data.","description":"EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form data. The request body is stored in LeadCaptureLogRecord.data and rendered unescaped when administrators view the log record, though Content Security Policy blocks JavaScript execution.","published":"2026-10-08T15:17:36.000Z","lastModified":"2026-10-08T18:17:15.000Z","status":"Deferred","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":5.3,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-79"],"affected":[],"epss":{"score":0.00267,"percentile":0.18697,"date":"2026-10-26","history":[{"date":"2026-10-09","score":0.00267,"percentile":0.17326}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.27%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-08T15:17:36.000Z","detail":{"score":"5.3","severity":"MEDIUM","publishedAt":"2026-10-08T15:17:35.507Z"},"summary":"New CVE, medium severity (CVSS 5.3)."}],"references":[{"url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-xfqv-j65r-qqgh","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/espocrm-before-10.0.6-unauthenticated-stored-html-injection-via-lead-capture-form","source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-105831","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}