cve.bz

CVE-2024-24818

5.9 mediumEPSS 0.6%

Medium (5.9) in espocrm espocrm. EPSS 0.6% chance of exploitation in the next 30 days.

EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" page and redirect victim to malicious page that could lead to credential stealing or another attack. This vulnerability is fixed in 8.1.2.

Severity

CVSS 3.1

5.9 medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
EPSS
0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-31)
CWEs
CWE-601, CWE-610
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON