What’s Vulnerable › Products
krayin laravel-crm vulnerabilities
19 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 19 published in the last 12 months.
Check whether your krayin laravel-crm version is affected
Latest krayin laravel-crm vulnerabilities
- CVE-2026-112288 — Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding (CVSS 3.3)
- CVE-2026-112287 — Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module (CVSS 7.1)
- CVE-2026-112286 — Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints (CVSS 6.5)
- CVE-2026-100885 — Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization (CVSS 7.3)
- CVE-2026-100884 — Krayin laravel-crm attachment-download Endpoint acl.php resource injection (CVSS 4.3)
- CVE-2026-100883 — Krayin laravel-crm acl.php access control (CVSS 6.3)
- CVE-2026-100882 — Krayin laravel-crm Admin Settings Endpoint index.blade.php cross site scripting (CVSS 2.4)
- CVE-2026-97897 — Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting (CVSS 3.5)
- CVE-2026-97896 — krayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting (CVSS 3.5)
- CVE-2026-97895 — krayin laravel-crm User Management UserController.php privileges management (CVSS 6.3)
- CVE-2026-48543 — Krayin CRM 2.2.6 Stored Template Injection XSS via Web Form Description (CVSS 5.4)
- CVE-2026-48542 — Krayin CRM 2.2.6 Stored Template Injection XSS via Product Name Field (CVSS 5.4)
- CVE-2026-48541 — Krayin CRM 2.2.6 Stored Template Injection XSS via Contact Name Field (CVSS 5.4)
- CVE-2026-48540 — Krayin CRM 2.2.6 Stored Template Injection XSS via Lead Title (CVSS 5.4)
- CVE-2026-90944 — Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse (CVSS 8.2)
- CVE-2026-41453 — Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter (CVSS 8.8)
- CVE-2026-41452 — Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup (CVSS 9.8)
- CVE-2026-61460 — Krayin CRM Insecure Direct Object Reference via Controllers (CVSS 8.8)
- CVE-2026-5370 — krayin laravel-crm Activities Module/Notes inbox.spec.ts composeMail cross site scripting (CVSS 3.5)