CVE-2019-14331: An issue was discovered in EspoCRM before 5.6.6.

Security readout for executives and security teams

EspoCRM before 5.6.6 allowed JavaScript to be stored in a user's first or last name. If viewed later by another user, that script could run in the viewer's browser. The sources do not provide a CVSS score or active exploitation evidence, but stored XSS in a CRM warrants timely remediation. Exposure is likely limited to organizations running EspoCRM versions before 5.6.6, especially where untrusted or lower-privileged users can create or modify user records. Treat this as a timely CRM hygiene fix, not an emergency unless your EspoCRM instance is internet-facing or allows broad user-management access. Upgrade and review existing user records. Mitigation focus: Upgrade EspoCRM to version 5.6.6 or later.; Confirm the vendor's referenced commit or release diff is present in deployed code.; Restrict who can create or modify user records until upgraded..

Prepared

Jun 6, 2026, 14:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.