CRM

espocrm/espocrm

EspoCRM – Open Source CRM Application

#crm#php#single-page-application#customer-portal#calendar#kanban#open-source#platform#sales-automation#customizable#email-marketing#contacts#leads#support#crm-platform#documents#customer-support#crm-system

スコア

/ 100

Star

2,963

Fork

855

Open Issue

サイズ

87MB

言語

PHP ★

最終push

0 日前

Docker

—

採点内訳

過去CVE 17件 (やや多い)

✓

直近 push: 0 日前

✓

得意言語 (PHP)

✓

オープンissue 50件

—

中規模 (87MB)

✓

Docker 未対応

—

1k–10k: 初心者ベスト (★2,963)

✓

※ 各項目の重みは「採点ルール」を参照。合計は 0 で底打ち。

過去の SecurityAdvisory (17 件)

MEDIUMGHSA-c3rm-m24p-255p CVE-2026-411602026/5/15
Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of notes
MEDIUMGHSA-vvmh-mf4h-96hw CVE-2026-411412026/5/8
IDOR in EmailTemplate Prepare Endpoint Leaks Entity Data via Email Address Lookup
MEDIUMGHSA-5wh5-ccv2-m3pv CVE-2026-337412026/5/8
Stored SVG attachment can execute same-origin uploaded JavaScript when opened via image or attachment entry points
HIGHGHSA-44c3-xjfp-3jrh CVE-2026-337332026/4/22
Admin TemplateManager path traversal allows arbitrary file read write and delete
CRITICALGHSA-7922-x7cf-j54x CVE-2026-336562026/4/22
Authenticated RCE via Formula with path traversal in attachment `sourceId`, exploitable by admin user
MEDIUMGHSA-wr7j-hxf8-hc4w CVE-2026-337402026/4/13
Email importEml can import and delete another user's attachment by raw fileId
MEDIUMGHSA-8prm-r5j9-j574 CVE-2026-336572026/4/13
Stored HTML injection in email notifications about stream notes via Markdown allowing HTML markup
LOWGHSA-6m4j-fwrx-crh7 CVE-2026-336592026/4/13
SSRF via DNS Rebinding in Attachment fromImageUrl Endpoint Allows Internal Network Access
MEDIUMGHSA-h7gx-8gwv-7g73 CVE-2026-335342026/4/13
Authenticated SSRF via internal-host validation bypass using alternative IPv4 notation
MEDIUMGHSA-c26c-wvhr-fr6r CVE-2025-594282025/10/14
Stored SVG <a> Injection Enabling CSRF-Based Arbitrary User Creation
MEDIUMGHSA-26x2-6wch-j8pf CVE-2025-528922025/8/4
Double slash in URI corrupting router cache leading to access denial
MEDIUMGHSA-rjm8-77fr-4f3v CVE-2025-525752025/7/21
Improper neutralization of special elements used in an LDAP query ('LDAP Injection')
MEDIUMGHSA-qrwp-v8v3-hqp2 CVE-2025-323902025/5/12
HTML Injection into phishing leads to account takeover
LOWGHSA-3ph3-jcfx-fq53 CVE-2025-327892025/4/16
Potential disclosure of sensitive information in the user sorting function
MEDIUMGHSA-2rf2-mj98-2fr8 CVE-2025-323852025/4/15
Unrestricted Embedding in Iframe dashlet
MEDIUMGHSA-8gv6-8r33-fm7j CVE-2024-248182024/2/29
Weakness in "Forgot password"
MEDIUMGHSA-g955-rwxx-jvf6 CVE-2023-467362023/12/5
SSRF via /Attachment/fromImageUrl endpoint