{"id":"CVE-2026-36341","aliases":["EUVD-2026-28390","GHSA-j822-46r5-h4qx"],"status":"published","title":"Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint","description":"Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5. The application fails to sanitize user-supplied input in the comment field during Activity creation on the /admin/activities/create endpoint","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0021,"percentile":0.11292,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2026-05-07T00:00:00Z","modified":"2026-10-28T02:30:24Z","exploits":[{"source":"pocgithub","id":"cybercrewinc/CVE-2026-36341","title":"cybercrewinc/CVE-2026-36341","date":"2026-04-30","url":"https://github.com/cybercrewinc/CVE-2026-36341"}],"fixes":[{"ecosystem":"Packagist","package":"krayin/laravel-crm","fixed_in":["2.1.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"krayin/laravel-crm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.5"},{"last_affected":"2.1.5"},{"fixed":"2.1.6"}]}],"versions":["2.1.5"]},{"source":"osv","ecosystem":"Packagist","package":"krayin/laravel-crm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.5"},{"fixed":"2.1.6"}]}],"versions":["2.1.5","v2.1.5"]}],"references":[{"url":"https://github.com/krayin/laravel-crm/releases/tag/v2.1.6","tags":["web"]},{"url":"https://github.com/krayin/laravel-crm/pull/2401","tags":["fix","web"]},{"url":"https://drive.google.com/file/d/1Y_WjD4Tiq_z7zQUlddFCFMDoyyN300r9/view","tags":["web"]},{"url":"https://cyber.spool.co.jp/vulnerabilities/cve-2026-36341/","tags":["exploit","web"]},{"url":"https://github.com/cybercrewinc/CVE-2026-36341","tags":["package","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-36341","tags":["advisory"]},{"url":"https://cyber.spool.co.jp/vulnerabilities/cve-2026-36341","tags":["web"]},{"url":"https://github.com/krayin/laravel-crm/commit/fc467040de21803cb2b67c2229d2dfcf731d2d3e","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j822-46r5-h4qx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/36xxx/CVE-2026-36341.json","tags":["advisory"]},{"url":"https://github.com/krayin/laravel-crm","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-36341","description":"Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5. The application fails to sanitize user-supplied input in the comment field during Activity creation on the /admin/activities/create endpoint","status":"published","published":"2026-05-07T00:00:00Z","modified":"2026-05-07T16:14:52.978Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:19:55.176387Z"}],"euvd":[{"id":"EUVD-2026-28390","description":"Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5. The application fails to sanitize user-supplied input in the comment field during Activity creation on the /admin/activities/create endpoint","status":"published","published":"2026-05-07T00:00:00Z","modified":"2026-05-07T16:14:52Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:05:14.902845Z"}],"ghsa":[{"id":"GHSA-j822-46r5-h4qx","title":"Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint","description":"Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5. The application fails to sanitize user-supplied input in the comment field during Activity creation on the /admin/activities/create endpoint","status":"published","published":"2026-05-07T18:30:40Z","modified":"2026-05-12T16:20:23Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:40:07.01746Z"}],"nvd":[{"id":"CVE-2026-36341","description":"Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5. The application fails to sanitize user-supplied input in the comment field during Activity creation on the /admin/activities/create endpoint","status":"published","published":"2026-05-07T16:16:18.9Z","modified":"2026-06-17T10:41:06.007Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:17.842772Z"}],"osv":[{"id":"CVE-2026-36341","description":"Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5. The application fails to sanitize user-supplied input in the comment field during Activity creation on the /admin/activities/create endpoint","status":"published","published":"2026-05-07T00:00:00Z","modified":"2026-10-28T02:30:24.557018182Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:02.673625Z"},{"id":"GHSA-j822-46r5-h4qx","title":"Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint","description":"Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5. The application fails to sanitize user-supplied input in the comment field during Activity creation on the /admin/activities/create endpoint","status":"published","published":"2026-05-07T18:30:40Z","modified":"2026-05-12T17:26:28.751323Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:49.977351Z"}]}}