CVE-2025-52575CWE-90

EspoCRM vulnerable to LDAP Injection through Improper Neutralization of Special Elements

Medium · published July 21, 2025

CVSS v3.1
6.5
EPSS
1%
Percentile
55.3
In the wild
Unconfirmed
What it is

EspoCRM is an Open Source CRM (Customer Relationship Management) software. EspoCRM versions 9.1.6 and earlier are vulnerable to blind LDAP Injection when LDAP authentication is enabled. A remote, unauthenticated attacker can manipulate LDAP queries by injecting crafted input containing wildcard characters (e.g., *). This may allow the attacker to bypass authentication controls, enumerate valid usernames, or retrieve sensitive directory information depending on the LDAP server configuration. This was fixed in version 9.1.7.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00776 · 55.3th percentile
Weakness
CWE-90 · Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Published
2025-07-21T17:48Z
EPSS history
Timeline
  • 21 JUL 17:48Z
    EspoCRM vulnerable to LDAP Injection through Improper Neutralization of Special Elements
    cvelistv5