The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a stored cross-site scripting vulnerability that allows low-privileged users to upload crafted SVG images that submit authenticated POST requests to arbitrary backend endpoints. Attackers can trick an administrator into opening the SVG in a separate browser tab and clicking it, performing administrator actions such as elevating the attacker's account to administrator.
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub