{"id":"CVE-2026-36340","aliases":["EUVD-2026-26382","GHSA-32px-ccfx-cxq3"],"status":"published","title":"Krayin CRM allows a remote attacker to execute arbitrary code via compose email function","description":"An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00568,"percentile":0.4739,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-94"],"published":"2026-04-30T00:00:00Z","modified":"2026-10-28T02:30:46Z","exploits":[{"source":"pocgithub","id":"cybercrewinc/CVE-2026-36340","title":"cybercrewinc/CVE-2026-36340","date":"2026-04-30","url":"https://github.com/cybercrewinc/CVE-2026-36340"}],"fixes":[{"ecosystem":"Packagist","package":"krayin/laravel-crm","fixed_in":["2.1.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"krayin/laravel-crm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.5"},{"last_affected":"2.1.5"},{"fixed":"2.1.6"}]}],"versions":["2.1.5"]},{"source":"osv","ecosystem":"Packagist","package":"krayin/laravel-crm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.5"},{"fixed":"2.1.6"}]}],"versions":["2.1.5","v2.1.5"]}],"references":[{"url":"https://drive.google.com/file/d/1yBdvbrXGf9fsFckmK9zTe2v8_vDtdicH/view","tags":["web"]},{"url":"https://github.com/krayin/laravel-crm/releases/tag/v2.1.6","tags":["web"]},{"url":"https://github.com/cybercrewinc/CVE-2026-36340","tags":["exploit","package","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-36340","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-32px-ccfx-cxq3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/36xxx/CVE-2026-36340.json","tags":["advisory"]},{"url":"https://github.com/krayin/laravel-crm","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-36340","description":"An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function","status":"published","published":"2026-04-30T00:00:00Z","modified":"2026-04-30T17:14:28.33Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:19:55.176387Z"}],"euvd":[{"id":"EUVD-2026-26382","description":"An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function","status":"published","published":"2026-04-30T00:00:00Z","modified":"2026-04-30T17:14:28Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:05:19.116327Z"}],"ghsa":[{"id":"GHSA-32px-ccfx-cxq3","title":"Krayin CRM allows a remote attacker to execute arbitrary code via compose email function","description":"An issue in Krayin CRM v.2.1.5, which was fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function.","status":"published","published":"2026-04-30T18:30:32Z","modified":"2026-05-07T01:16:53Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:40:02.883746Z"}],"nvd":[{"id":"CVE-2026-36340","description":"An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function","status":"published","published":"2026-04-30T16:16:42.16Z","modified":"2026-06-17T10:41:05.86Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:12:16.626888Z"}],"osv":[{"id":"CVE-2026-36340","description":"An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function","status":"published","published":"2026-04-30T00:00:00Z","modified":"2026-10-28T02:30:46.840418233Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:02.673625Z"},{"id":"GHSA-32px-ccfx-cxq3","title":"Krayin CRM allows a remote attacker to execute arbitrary code via compose email function","description":"An issue in Krayin CRM v.2.1.5, which was fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function.","status":"published","published":"2026-04-30T18:30:32Z","modified":"2026-05-07T01:41:25.141827Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:35.050232Z"}]}}