CVE-2019-14330: An issue was discovered in EspoCRM before 5.6.6.

Security readout for executives and security teams

CVE-2019-14330 is a stored cross-site scripting issue in EspoCRM before 5.6.6. Malicious JavaScript could be saved in firstName or lastName data during Create Case and later run when viewed. This is primarily a risk to CRM users and sensitive CRM workflows, not evidence of system-level compromise by itself. Organizations running EspoCRM versions earlier than 5.6.6 may be exposed, especially where untrusted users or external workflows can create cases or influence firstName and lastName values. The bundle does not provide CPEs, deployment details, or exact privilege requirements. Prioritize remediation for internet-facing or externally integrated EspoCRM systems, and for CRM environments used by administrators or sales and support teams handling sensitive customer data. Treat as time-bound patching rather than an emergency unless local evidence indicates abuse. Mitigation focus: Upgrade EspoCRM to version 5.6.6 or later.; Review EspoCRM vendor guidance and the referenced fix commit.; Inspect existing case data for script-like content in firstName or lastName..

Prepared

Jun 6, 2026, 14:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.