CVE-2025-32390

EspoCRM is a free, open-source customer relationship management platform. Prior to version 9.0.8, HTML Injection in Knowledge Base (KB) articles leads to complete page defacement imitating the login page. Authenticated users with the read knowledge article privilege can browse to the KB article and if they submit their credentials, they get captured in plain text. The vulnerability is allowed by overly permissive HTML editing being allowed on the KB articles. Any authenticated user with the privilege to read KB articles is impacted. In an enterprise with multiple applications, the malicious KB article could be edited to match the login pages of other applications, which would make it useful for credential harvesting against other applications as well. Version 9.0.8 contains a patch for the issue.

• CWE-74

• https://github.com/espocrm/espocrm/commit/6b58d30eec8864de52844bfb8dac346ce5c729d7Patch
• https://github.com/espocrm/espocrm/security/advisories/GHSA-qrwp-v8v3-hqp2Exploit, Vendor Advisory

Published

May 12, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-32385EspoCRM is an Open Source Customer Relationship Management s…6.5
• CVE-2025-32386Helm is a tool for managing Charts. A chart archive file can…6.5
• CVE-2025-32387Helm is a package manager for Charts for Kubernetes. A JSON …6.5
• CVE-2025-32388SvelteKit is a framework for rapidly developing robust, perf…5.4
• CVE-2025-32389NamelessMC is a free, easy to use & powerful website softwar…6.5
• CVE-2025-3239A vulnerability classified as critical was found in PHPGuruk…9.8
• CVE-2025-32391HedgeDoc is an open source, real-time, collaborative, markdo…4.6
• CVE-2025-32392AutoGPT is a workflow automation platform for creating, depl…8.7
• CVE-2025-32393AutoGPT is a platform that allows users to create, deploy, a…6.5
• CVE-2025-32394AutoGPT is a workflow automation platform for creating, depl…5.3
• CVE-2025-32395Vite is a frontend tooling framework for javascript. Prior t…6
• CVE-2025-32396An Heap-based Buffer Overflow in RT-Labs P-Net version 1.0.1…7.5