Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint

Description

References

• nvd.nist.gov/vuln/detail/CVE-2026-36341 · ADVISORY
• krayin/laravel-crm#2401 · WEB
• krayin/laravel-crm commit fc46704 · WEB
• cyber.spool.co.jp/vulnerabilities/cve-2026-36341 · WEB
• drive.google.com/file/d/1Y_WjD4Tiq_z7zQUlddFCFMDoyyN300r9/view · WEB
• cybercrewinc/CVE-2026-36341 · WEB
• krayin/laravel-crm · PACKAGE
• krayin/laravel-crm release v2.1.6 · WEB
• cyber.spool.co.jp/vulnerabilities/cve-2026-36341

Mais vulnerabilidades de krayin/laravel-crm

• CVE-2026-36340ALTO 8.1An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function
• CVE-2026-38532ALTO 8.1A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenti…
• CVE-2026-38530ALTO 8.1A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authentic…
• CVE-2026-38529ALTO 8.8A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated att…
• CVE-2026-38527ALTO 8.5A Server-Side Request Forgery (SSRF) in the /settings/webhooks/create component of Webkul Krayin CRM v2.2.x allows attackers to scan interna…