Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

EspoCRM iframe dashlet can enable phishing attacks

CVE-2025-32385 · published 1 year ago
Summary

EspoCRM versions before 9.0.5 let users add any web page into a dashboard widget without restricting its behavior. Because the widget does not use a security sandbox, a malicious page could open pop‑up windows or send messages that may trick users into revealing information. Upgrade to EspoCRM 9.0.5 or later to apply the fix.

What to do
  • Update espocrm espocrm to version 9.0.5 or later.
Affected software
VendorProductAffected versions
espocrm espocrm < 9.0.5
cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*
Original advisory text
EspoCRM allows unrestricted Embedding in Iframe dashlet
EspoCRM is an Open Source Customer Relationship Management software. Prior to 9.0.5, Iframe dashlet allows user to display iframes with arbitrary URLs. As the sandbox attribute is not included in the iframe, the remote page can open popups outside of the iframe, potentially tricking users and creating a phishing risk. The iframe URL is user-defined, so an attacker would need to trick the user into specifying a malicious URL. The missing sandbox attribute also allows the remote page to send messages to the parent frame. However, EspoCRM does not make use of these messages. This vulnerability is fixed in 9.0.5.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-1021Improper Restriction of Rendered UI Layers or Frames
Timeline
Published15 Apr 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-32385 · NVD
CVE-2025-32385 · OSV
GHSA-2rf2-mj98-2fr8 · GHSA
Track software like this
Free during beta