Skip to contentKrayin Laravel-crm vulnerabilities
- krayin laravel-crmKrayin CRM before 2.2.8 Broken Object Level Authorization via Lead Tag Attach/DetachCVE-2026-1253745.3 Medium
- krayin laravel-crmKrayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS RebindingCVE-2026-1122882.1 Low
- krayin laravel-crmKrayin CRM before 2.2.7 Broken Object Level Authorization in Mail ModuleCVE-2026-1122877.1 High
- krayin laravel-crmKrayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products EndpointsCVE-2026-1122867.1 High
- krayin laravel-crmVentureDrake Laravel CRM before 2.4.0 Privilege Escalation via Unscoped Role AssignmentCVE-2026-1106307.0 High
- krayin laravel-crmVentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire ActionsCVE-2026-1106297.1 High
- krayin laravel-crmKrayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorizationCVE-2026-100885Public exploit6.9 Medium
- krayin laravel-crmKrayin laravel-crm attachment-download Endpoint acl.php resource injectionCVE-2026-1008845.3 Medium
- krayin laravel-crmKrayin laravel-crm acl.php access controlCVE-2026-1008835.3 Medium
- krayin laravel-crmKrayin laravel-crm Admin Settings Endpoint index.blade.php cross site scriptingCVE-2026-1008824.8 Medium
- krayin laravel-crmKrayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scriptingCVE-2026-978975.1 Medium
- krayin laravel-crmkrayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scriptingCVE-2026-978965.1 Medium
- krayin laravel-crmkrayin laravel-crm User Management UserController.php privileges managementCVE-2026-978955.3 Medium
- krayin laravel-crmKrayin CRM 2.2.6 Stored Template Injection XSS via Web Form DescriptionCVE-2026-485435.1 Medium
- krayin laravel-crmKrayin CRM 2.2.6 Stored Template Injection XSS via Product Name FieldCVE-2026-485425.1 Medium
- krayin laravel-crmKrayin CRM 2.2.6 Stored Template Injection XSS via Contact Name FieldCVE-2026-485415.1 Medium
- krayin laravel-crmKrayin CRM 2.2.6 Stored Template Injection XSS via Lead TitleCVE-2026-485405.1 Medium
- krayin laravel-crmKrayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parseCVE-2026-909448.8 High
- krayin laravel-crmKrayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead ParameterCVE-2026-414538.7 High
- krayin laravel-crmKrayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setupCVE-2026-41452Public exploit9.3 Critical
- krayin laravel-crmKrayin CRM Insecure Direct Object Reference via ControllersCVE-2026-614608.7 High
- krayin laravel-crmkrayin laravel-crm Activities Module/Notes inbox.spec.ts composeMail cross site scriptingCVE-2026-53705.1 Medium