EUVD-2026-18484Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was identified in krayin laravel-crm up to 2.2. Impacted is the function composeMail of the file packages/Webkul/Admin/tests/e2e-pw/tests/mail/inbox.spec.ts of the component Activities Module/Notes Module. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is 73ed28d466bf14787fdb86a120c656a4af270153. To fix this issue, it is recommended to deploy a patch.
AnalysisAI
Stored cross-site scripting (XSS) in Krayin Laravel-CRM up to version 2.2 allows authenticated users with low privileges to inject malicious scripts via the composeMail function in the Activities/Notes Module, which are then executed when other users view the content. The vulnerability requires user interaction (UI:P) but has confirmed publicly available exploit code and a vendor-released patch (commit 73ed28d466bf14787fdb86a120c656a4af270153), making it a moderate priority for deployments where multiple users interact with notes and mail features.
Technical ContextAI
The vulnerability is a reflected or stored XSS vulnerability (CWE-79) in the composeMail function within the e2e test file structure of Krayin's Laravel-CRM Activities/Notes Module. The CVSS v4.0 vector shows the attack requires network access (AV:N), low attack complexity (AC:L), authenticated privileges (PR:L), and user interaction (UI:P), with integrity impact (VI:L) on the application's data representation. Laravel-CRM is a customer relationship management system built on the Laravel framework, and the vulnerability exists in the mail composition component where user-supplied input is not properly sanitized before being rendered in the UI, allowing script injection.
RemediationAI
Apply the vendor-released patch from commit 73ed28d466bf14787fdb86a120c656a4af270153 via GitHub pull request 2466. This can be implemented by updating Krayin Laravel-CRM to a version that includes this commit (versions after the patch merge date). Users should verify the exact patched version number from the Krayin project releases page at https://github.com/krayin/laravel-crm/releases. In the interim, restrict mail composition and notes features to trusted administrators only, or implement web application firewall rules to sanitize or block script tags in mail/notes input fields. The vendor advisory and detailed patch information are available at https://github.com/krayin/laravel-crm/pull/2466 and https://github.com/krayin/laravel-crm/issues/2419.
More in Laravel Crm
View allAdministrative account takeover in Krayin CRM (Laravel CRM) 2.2.4 lets unauthenticated remote attackers overwrite the pr
Blind SQL injection in Krayin CRM's leads DataGrid allows any authenticated user with leads access to exfiltrate the ent
Broken object-level authorization in Krayin CRM (Laravel CRM) through version 2.2.3 lets any authenticated user tamper w
Missing authentication on Krayin CRM's admin mail ingest route lets any remote, unauthenticated attacker POST crafted RF
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today