GitHub Advisoryadvisory · Packagist

GHSA-j822-46r5-h4qx Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint

MEDIUM Published 2026-05-07 Modified 2026-05-12 Official page ↗
Aliases
CVE-2026-36341
Ecosystem
Packagist
Packages
krayin/laravel-crm
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2026-05-12

Affected packages

• Packagist krayin/laravel-crm: >= 2.1.5, < 2.1.6 → fixed in 2.1.6

Description

Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5. The application fails to sanitize user-supplied input in the comment field during Activity creation on the /admin/activities/create endpoint

Related

Alias · CVE (1)

  • CVE-2026-36341 Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References