EspoCRM version 9.3.8 and earlier allow an authenticated administrator to insert crafted content into the applicationName setting through CSP nonce injection. The injected payload is written to the main page without proper escaping, creating a persistent cross‑site scripting flaw. Malicious JavaScript can execute in the browser context of any user visiting the application, allowing attackers to exfiltrate page data, including unsaved form input, and potentially hijack user sessions. The weakness corresponds to CWE‑79, a classic instance of reflected or stored XSS.

EspoCRM is affected when deployed using versions earlier than 9.3.9. The vulnerability exists in the configuration setting for the application name; administrators with edit rights can exploit it.

The reported CVSS score is 2.7, categorizing the threat as low severity. The EPSS score is below 1%, indicating a very low exploitation likelihood at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to be an authenticated administrator with permission to modify the applicationName setting, after which the malicious JavaScript is served to all users who view the main page.