PT-2026-146636

CVE-2026-126305

Published

2026-11-13

Updated

2026-11-13

Description by

CVSS 4.0

8.5

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 9.3.11 EspoCRM versions 10.x prior to 10.0.9

Description A stored cross-site scripting issue exists in Knowledge Base articles. Users with permissions to create or edit articles can attach a JavaScript file and insert a crafted link into the article body. If an administrator clicks this link, the script executes within their session, potentially allowing the creation of a new administrator account with credentials specified by the attacker.

Recommendations Update to version 9.3.11 or later. Update to version 10.0.9 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Paius-George

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers