CVE-2019-14546

CVE-2019-14546 is a stored Cross-Site Scripting (XSS) vulnerability affecting EspoCRM versions prior to 5.6.9. An authenticated attacker can inject malicious JavaScript into their email signature, which executes when a victim replies to or forwards the email, potentially leading to cookie theft and account compromise. The vulnerability has a CVSS score of 5.4 (Medium), indicating a network-based attack with low privileges required, but user interaction is necessary for exploitation. The potential impact includes limited confidentiality and integrity compromise. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal.