CVE-2026-53574

HighCVSS 7.6/10Last modified Oct 15, 2026

Description

EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injection can extract arbitrary database information, including active administrator session tokens, and can enable full privilege escalation. This issue is fixed in version 9.3.8.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Oct 15, 2026
Last modified: Oct 15, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-535752.7EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authenticated administrator can place crafted con CVE-2026-5357610.0Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filt CVE-2026-535776.5Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the previewFileFromExecution endpoint (GET /api/v CVE-2026-535786.1Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter CVE-2026-535796.1Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter CVE-2026-535808.1Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts f CVE-2026-535819.0OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core,CVE-2026-535827.1OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate CVE-2026-535836.5libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functi CVE-2026-535844.3libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functi CVE-2026-535855.3libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functi CVE-2026-535866.5libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functi