CVE-2019-14547

CVE-2019-14547 describes a stored cross-site scripting (XSS) vulnerability in EspoCRM versions prior to 5.6.9. An authenticated attacker could embed malicious JavaScript within an attachment's filename, which would execute when an administrator or user selected that file from the attachments list. This could lead to cookie theft and account compromise. The vulnerability has a CVSS score of 5.4 (Medium), indicating a network-based attack with low privileges required, but user interaction is necessary for exploitation. The potential impact involves low confidentiality and integrity loss. There is currently no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal.