EUVD-2026-26382
Code Injection (CWE-94)
GHSA-32px-ccfx-cxq3
8.1
CVSS 3.1
Share
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Lifecycle Timeline
6
Source Code Evidence Fetched
Apr 30, 2026 - 18:45 vuln.today
Analysis Generated
Apr 30, 2026 - 18:45 vuln.today
CVSS changed
Apr 30, 2026 - 18:22 NVD
8.1 (HIGH)
EUVD ID Assigned
Apr 30, 2026 - 16:15 euvd
EUVD-2026-26382
Analysis Generated
Apr 30, 2026 - 16:15 vuln.today
CVE Published
Apr 30, 2026 - 00:00 nvd
HIGH 8.1
DescriptionNVD
An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function
AnalysisAI
Remote code execution in Krayin CRM 2.1.5 allows authenticated attackers to execute arbitrary code through the compose email function via code injection. The vulnerability was patched in version 2.1.6 released by the vendor. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all Krayin CRM deployments and identify instances running version 2.1.5 or earlier. Within 7 days: Upgrade to Krayin CRM 2.1.6 or later on all affected systems. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).