What is the CVSS score of EUVD-2026-22299?

EUVD-2026-22299 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by EUVD-2026-22299?

Krayin CRM 2.2.x contains a SQL injection vulnerability in lead management that allows authenticated users with low-privilege credentials to extract sensitive database contents, potentially exposing…

How to fix or mitigate EUVD-2026-22299?

Within 24 hours: Inventory all instances of Krayin CRM 2.2.x in your environment and restrict database query logging to detect exploitation attempts via the rotten_lead parameter in LeadDataGrid.php. Within 7 days: Limit CRM access to essential users only, enforce strong password policies for CRM accounts, and review database access logs for suspicious queries. Within 30 days: Upgrade to Krayin CRM 3.0 or later (if available and tested), or implement a Web Application Firewall (WAF) rule blocking SQL syntax in the rotten_lead parameter as an interim control; evaluate migration to alternative CRM solutions if patched versions are unavailable.

PHP EUVD-2026-22299

| CVE-2026-38528 HIGH

SQL Injection (CWE-89)

2026-04-14 mitre

GHSA-hjjv-j557-q7r3

PHP SQLi

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:37 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 17:01 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 16:00 euvd

EUVD-2026-22299

Analysis Generated

Apr 14, 2026 - 16:00 vuln.today

CVE Published

Apr 14, 2026 - 00:00 nvd

HIGH 7.1

DescriptionCVE.org

Krayin CRM v2.2.x was discovered to contain a SQL injection vulnerability via the rotten_lead parameter at /Lead/LeadDataGrid.php.

AnalysisAI

SQL injection in Krayin CRM 2.2.x allows authenticated remote attackers to extract sensitive database contents via the rotten_lead parameter in LeadDataGrid.php. CVSS 7.1 severity with network attack vector and low complexity enables database enumeration with low-privilege credentials. No public exploit identified at time of analysis, though EPSS data unavailable. Technical advisory published on GitHub indicates vulnerability affects lead management functionality in this Laravel-based open-source CRM platform.

Technical ContextAI

Krayin CRM is a Laravel-based open-source customer relationship management system written in PHP. The vulnerability exists in the LeadDataGrid.php component responsible for rendering lead data grids, where the rotten_lead parameter lacks proper input sanitization before being incorporated into SQL queries. SQL injection (SQLi) vulnerabilities occur when user-controlled input is concatenated directly into SQL statements without parameterization or escaping, allowing attackers to manipulate query logic. In Laravel applications, this typically indicates improper use of raw queries or query builder methods that bypass the framework's built-in protections. The lead management module appears to process filtering or sorting parameters without adequate validation, enabling arbitrary SQL statement injection through crafted HTTP requests to the affected endpoint.

RemediationAI

Upgrade Krayin CRM to a patched version addressing CVE-2026-38528 once released by the vendor. Consult the official Krayin GitHub repository at github.com/krayin/laravel-crm for security updates and patch availability. Monitor the security advisory published at github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38528 for remediation guidance and vendor response timeline. Until a vendor patch is available, implement compensating controls including restricting CRM user account creation to trusted personnel only, enabling comprehensive database query logging to detect injection attempts, implementing web application firewall rules to filter SQL metacharacters in the rotten_lead parameter, and applying principle of least privilege by limiting database permissions for the CRM application service account to prevent lateral movement post-exploitation. Review all user accounts with CRM access to ensure no unauthorized or dormant credentials exist that could be leveraged for exploitation. Consider temporary disabling or restricting access to the lead data grid filtering functionality if operationally feasible until patches are deployed.