CVE-2026-36341
Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint
mediumEPSS 0.3%
Affected
- packagist/krayin/laravel-crm
2.1.5..* - packagist/krayin/laravel-crm
v2.1.5..*
Description
Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5. The application fails to sanitize user-supplied input in the comment field during Activity creation on the /admin/activities/create endpoint
Affected products
The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.
packagistkrayin/laravel-crm
2.1.5v2.1.5Metrics
Show all metrics
Severity
medium
48.41
no public PoC known
5.4
Published
2026-05-07 18:30 UTC
References & sources
- https://nvd.nist.gov/vuln/detail/CVE-2026-36341advisory
- https://github.com/krayin/laravel-crm/pull/2401web
- https://github.com/krayin/laravel-crm/commit/fc467040de21803cb2b67c2229d2dfcf731d2d3eweb
- https://cyber.spool.co.jp/vulnerabilities/cve-2026-36341web
- https://drive.google.com/file/d/1Y_WjD4Tiq_z7zQUlddFCFMDoyyN300r9/viewweb
- https://github.com/cybercrewinc/CVE-2026-36341web
- https://github.com/krayin/laravel-crmpackage
- https://github.com/krayin/laravel-crm/releases/tag/v2.1.6web
- https://cyber.spool.co.jp/vulnerabilities/cve-2026-36341/