CVE-2025-32385

EspoCRM is an Open Source Customer Relationship Management software. Prior to 9.0.5, Iframe dashlet allows user to display iframes with arbitrary URLs. As the sandbox attribute is not included in the iframe, the remote page can open popups outside of the iframe, potentially tricking users and creating a phishing risk. The iframe URL is user-defined, so an attacker would need to trick the user into specifying a malicious URL. The missing sandbox attribute also allows the remote page to send messages to the parent frame. However, EspoCRM does not make use of these messages. This vulnerability is fixed in 9.0.5.

• CWE-1021

• https://github.com/espocrm/espocrm/security/advisories/GHSA-2rf2-mj98-2fr8Vendor Advisory

Published

Apr 16, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-32379Koa is expressive middleware for Node.js using ES2017 async …6.1
• CVE-2025-3238A vulnerability classified as critical has been found in PHP…9.8
• CVE-2025-32380The Apollo Router Core is a configurable, high-performance g…7.5
• CVE-2025-32381XGrammar is an open-source library for efficient, flexible, …6.5
• CVE-2025-32382Metabase is an open source Business Intelligence and Embedde…1.8
• CVE-2025-32383MaxKB (Max Knowledge Base) is an open source knowledge base …7.2
• CVE-2025-32386Helm is a tool for managing Charts. A chart archive file can…6.5
• CVE-2025-32387Helm is a package manager for Charts for Kubernetes. A JSON …6.5
• CVE-2025-32388SvelteKit is a framework for rapidly developing robust, perf…5.4
• CVE-2025-32389NamelessMC is a free, easy to use & powerful website softwar…6.5
• CVE-2025-3239A vulnerability classified as critical was found in PHPGuruk…9.8
• CVE-2025-32390EspoCRM is a free, open-source customer relationship managem…8.5