CVE-2024-24818

PoC —

CVSS 3.1

5.9 medium

EPSS

<1%p48

Published

Mar 21, 2024 (Mar 21, 2024)

Modified

Jun 17, 2026

Description

EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" page and redirect victim to malicious page that could lead to credential stealing or another attack. This vulnerability is fixed in 8.1.2.

Vendors: espocrm
Products: espocrm
Weakness: CWE-610, CWE-601
Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.