Krayin Laravel-Crm
19 CVEs affecting Krayin Laravel-Crm. Latest disclosed: 2026-10-19. Critical: 1, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-41452 | Critical | 9.8 | 2026-08-03 | Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the prim… |
CVE-2026-41453 | High | 8.8 | 2026-08-03 | Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrar… |
CVE-2026-61460 | High | 8.8 | 2026-07-10 | Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadController, PersonController, OrganizationController, QuoteControlle… |
CVE-2026-90944 | High | 8.2 | 2026-09-14 | Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary ema… |
CVE-2026-100885 | High | 7.3 | 2026-09-27 | A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInst… |
CVE-2026-112287 | High | 7.1 | 2026-10-19 | Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated… |
CVE-2026-112286 | Medium | 6.5 | 2026-10-19 | Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes… |
CVE-2026-100883 | Medium | 6.3 | 2026-09-27 | A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file packages/Webkul/Admin/src/Config/acl.php. Exec… |
CVE-2026-97895 | Medium | 6.3 | 2026-09-25 | A vulnerability was determined in krayin laravel-crm up to 2.2.5. This affects an unknown part of the file packages/Webkul/Admin/src/Http/Controllers/Settings/… |
CVE-2026-48543 | Medium | 5.4 | 2026-09-24 | Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in… |
CVE-2026-48542 | Medium | 5.4 | 2026-09-24 | Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in… |
CVE-2026-48541 | Medium | 5.4 | 2026-09-24 | Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in… |
CVE-2026-48540 | Medium | 5.4 | 2026-09-24 | Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in… |
CVE-2026-100884 | Medium | 4.3 | 2026-09-27 | A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download of the file packages/Webkul/Admin/src/… |
CVE-2026-97897 | Low | 3.5 | 2026-09-25 | A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component Ti… |
CVE-2026-97896 | Low | 3.5 | 2026-09-25 | A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationForm::rules of the file packages/Webkul/… |
CVE-2026-5370 | Low | 3.5 | 2026-04-02 | A vulnerability was identified in krayin laravel-crm up to 2.2. Impacted is the function composeMail of the file packages/Webkul/Admin/tests/e2e-pw/tests/mail/… |
CVE-2026-112288 | Low | 3.3 | 2026-10-19 | Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via D… |
CVE-2026-100882 | Low | 2.4 | 2026-09-27 | A vulnerability was detected in Krayin laravel-crm up to 2.2.5. Impacted is an unknown function of the file packages/Webkul/Admin/src/Resources/views/component… |