CVE-2026-36340
Krayin CRM allows a remote attacker to execute arbitrary code via compose email function
An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function
- Record
CVE-2026-36340- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2026-26382
An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function
- Record
EUVD-2026-26382- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-32px-ccfx-cxq3
Krayin CRM allows a remote attacker to execute arbitrary code via compose email function
An issue in Krayin CRM v.2.1.5, which was fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function.
- Record
GHSA-32px-ccfx-cxq3- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function
- Record
CVE-2026-36340- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function
- Record
CVE-2026-36340- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-32px-ccfx-cxq3
Krayin CRM allows a remote attacker to execute arbitrary code via compose email function
An issue in Krayin CRM v.2.1.5, which was fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function.
- Record
GHSA-32px-ccfx-cxq3- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-94
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
krayin/laravel-crmPackagist |
2.1.5 to 2.1.5 | 2.1.6 |
krayin/laravel-crmPackagist |
2.1.5 up to 2.1.6, plus listed versions v2.1.5 |
2.1.6 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | cybercrewinc/CVE-2026-36340 | 2026-04-30 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-36340 is a high vulnerability (CVSS 8.1) in krayin/laravel-crm, published April 30, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.57%, the 47th percentile. Fixed in krayin/laravel-crm 2.1.6.
References
drive.google.com/file/d/1yBdvbrXGf9fsFckmK9zTe2v8_vDtdicH/view
github.com/krayin/laravel-crm/releases/tag/v2.1.6
nvd.nist.gov/vuln/detail/CVE-2026-36340