CVE-2026-5370mediumCWE-79CWE-94

CVE-2026-5370: fallo de gravedad media en krayin laravel-crm

krayin laravel-crm Activities Module/Notes inbox.spec.ts composeMail cross site scripting

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear laravel-crm+ Monitorear krayin/laravel-crm

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 5.1epss 0.2%
A vulnerability was identified in krayin laravel-crm up to 2.2. Impacted is the function composeMail of the file packages/Webkul/Admin/tests/e2e-pw/tests/mail/inbox.spec.ts of the component Activities Module/Notes Module. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is 73ed28d466bf14787fdb86a120c656a4af270153. To fix this issue, it is recommended to deploy a patch.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Productos afectados
krayin · laravel-crm
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — krayin laravel-crm

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-41452CRITICALKrayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setupEPSS 3.7%CVE-2026-90944HIGHKrayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parseEPSS 0.7%CVE-2026-61460HIGHKrayin CRM Insecure Direct Object Reference via ControllersEPSS 0.5%CVE-2026-41453HIGHKrayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead ParameterEPSS 0.5%CVE-2026-97895MEDIUMkrayin laravel-crm User Management UserController.php privileges managementEPSS 0.3%CVE-2026-125374MEDIUMKrayin CRM before 2.2.8 Broken Object Level Authorization via Lead Tag Attach/DetachEPSS 0.3%