CVE-2019-14329: An issue was discovered in EspoCRM before 5.6.6.

Security readout for executives and security teams

CVE-2019-14329 is a stored cross-site scripting issue in EspoCRM before 5.6.6. User-supplied task data was not filtered properly, allowing JavaScript to be saved through the Create Task workflow. The business risk is account/session abuse or misleading actions if a privileged user views affected content. Exposure is most likely where EspoCRM before 5.6.6 is deployed and users can create tasks. The sources do not provide CPEs, deployment scope, CVSS, authentication requirements, or affected configurations beyond the version boundary. Prioritize remediation for internet-facing or broadly used EspoCRM systems, especially where many users create tasks. The lack of CVSS and exploitation evidence lowers urgency compared with known-exploited flaws, but stored XSS in CRM workflows can still affect privileged users and business data. Mitigation focus: Identify all EspoCRM deployments and record installed versions.; Upgrade EspoCRM deployments older than 5.6.6 to 5.6.6 or later.; Review the linked EspoCRM commit and 5.6.6 comparison for fix context..

Prepared

Jun 6, 2026, 14:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.