{"answers":{"affected":"It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-32390 exists.","fix":"No fix has been published for CVE-2025-32390 yet. Limit exposure of the affected software until one is available.","what":"CVE-2025-32390 is a high-severity cross-site scripting vulnerability in espocrm, published on 12 May 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2025-32390 and fix it if it is affected.\n\nWhat it is: CVE-2025-32390 is a high-severity cross-site scripting vulnerability in espocrm, published on 12 May 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-32390 exists.\n\nAffected product: espocrm. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-32390/ (Markdown: https://insights.sbomify.com/CVE-2025-32390/index.md)","id":"CVE-2025-32390","markdown":"https://insights.sbomify.com/CVE-2025-32390/index.md","name":"CVE-2025-32390","record":{"aliases":["GHSA-qrwp-v8v3-hqp2"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["account_takeover","data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"CRM platform","requires_auth":"low_privilege","summary":"Authenticated users can inject HTML into Knowledge Base articles to deface pages and harvest credentials, leading to account takeover.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"espocrm","vendor":"espocrm"}],"cvss":{"score":7,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","version":"4.0"},"cwes":[{"id":"CWE-74","name":"Improper Neutralization of Special Elements in Output Used by a Downstream Component"}],"description":"EspoCRM is a free, open-source customer relationship management platform. Prior to version 9.0.8, HTML Injection in Knowledge Base (KB) articles leads to complete page defacement imitating the login page. Authenticated users with the read knowledge article privilege can browse to the KB article and if they submit their credentials, they get captured in plain text. The vulnerability is allowed by overly permissive HTML editing being allowed on the KB articles. Any authenticated user with the privilege to read KB articles is impacted. In an enterprise with multiple applications, the malicious KB article could be edited to match the login pages of other applications, which would make it useful for credential harvesting against other applications as well. Version 9.0.8 contains a patch for the issue.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":false,"headline":"EspoCRM vulnerable to HTML Injection into phishing, which may lead to account takeover","id":"CVE-2025-32390","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"xss","year":"2025"},"n_packages":0,"n_references":2,"next":{"headline":"HedgeDoc allows XSS possibility through malicious SVG uploads","id":"CVE-2025-32391"},"packages":[],"prev":{"headline":"NamelessMC Vulnerable to SQL Injections in /user/messaging and /panel/users/reports Pages","id":"CVE-2025-32389"},"products":["espocrm"],"published":"2025-05-12","related":[{"cvss_score":10,"headline":"Path traversal in n/a","id":"CVE-2014-7985","kev_date_added":null,"published":"2014-10-31"},{"cvss_score":9.1,"headline":"Path traversal in espocrm","id":"CVE-2026-33656","kev_date_added":null,"published":"2026-04-22"},{"cvss_score":8.8,"headline":"File upload in n/a","id":"CVE-2022-38843","kev_date_added":null,"published":"2022-09-16"},{"cvss_score":8.8,"headline":"Information disclosure in n/a","id":"CVE-2019-14351","kev_date_added":null,"published":"2019-07-28"},{"cvss_score":8.6,"headline":"EspoCRM 5.7.0 \u003c 5.9.0 - Two-Factor Authentication Bypass via Auth Token Reuse Between Accounts with Identical Passwords","id":"CVE-2020-37094","kev_date_added":null,"published":"2026-02-03"},{"cvss_score":8,"headline":"Code injection in n/a","id":"CVE-2022-38844","kev_date_added":null,"published":"2022-09-16"},{"cvss_score":7.2,"headline":"EspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and delete","id":"CVE-2026-33733","kev_date_added":null,"published":"2026-04-22"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-05-12","vendors":["espocrm"]},"summary":"Authenticated users can inject HTML into Knowledge Base articles to deface pages and harvest credentials, leading to account takeover.","url":"https://insights.sbomify.com/CVE-2025-32390/"}