CVE-2026-126305
HIGH
NVD
CVSS Score
7.3
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
EspoCRM before 9.3.11 and 10.x before 10.0.9 contains a stored cross-site scripting vulnerability in Knowledge Base articles that lets users with Knowledge Base create or edit access attach a JavaScript file and add a crafted link to the article body. When an administrator clicks the link, the script runs in their session and can create an administrator account with attacker-chosen credentials.