CVE-2023-5965

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbitrary PHP code execution.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
EspoCRM	EspoCRM	<= 7.5.2

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-espocrmThird Party Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-espocrmThird Party Advisory

Timeline

Published: Nov 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-59667.2An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the extension deployme CVE-2023-59674.3Mattermost fails to properly validate requests to the Calls plugin, allowing an attacker sending a request without a User Agent header to ca CVE-2023-59684.9Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the respo CVE-2023-59695.3Mattermost fails to properly sanitize the request to /api/v4/redirect_location allowing an attacker, sending a specially crafted request to CVE-2023-59708.8Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external d CVE-2023-59714.8The Save as PDF Plugin by Pdfcrowd WordPress plugin before 3.2.0 does not sanitise and escape some of its settings, which could allow high p CVE-2023-59727.8A null pointer dereference flaw was found in the nft_inner.c functionality of netfilter in the Linux kernel. This issue could allow a local CVE-2023-59734.3Brocade Web Interface in Brocade Fabric OS v9.x and before v9.2.0 does not properly represent the portName to the user if the portName con CVE-2023-59749.8The WPB Show Core WordPress plugin through 2.2 is vulnerable to server-side request forgery (SSRF) via the `path` parameter.CVE-2023-59754.3The ImageMapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to mis CVE-2023-59764.3Improper Access Control in GitHub repository microweber/microweber prior to 2.0.CVE-2023-59787.5In versions of FreeBSD 13-RELEASE before 13-RELEASE-p5, under certain circumstances the cap_net libcasper(3) service incorrectly validates t