EUVD-2026-88045
GHSA-j3pj-939h-hrf6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as privileged admin
-
DeliverySubmit XSS payload in footer.label setting
-
ExploitPayload stored unsanitized
-
ExecutionVictim admin loads page
-
ImpactScript executes in browser session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated administrator with access to the Admin Settings endpoint to set the 'general.settings.footer.label' configuration value (PR:H) - this is not reachable by unauthenticated or low-privileged users. Exploitation as stored XSS additionally requires a victim user (another admin) to load an admin page rendering the footer (UI:P). This is effectively an admin-to-admin / self-XSS scenario; the impact is limited to the admin panel context and confined to integrity (script execution in browser), with no confidentiality or availability impact per the vector. Affects Krayin laravel-crm up to and including 2.2.5; fixed in 2.2.6. |
| Impact | This is a genuinely low-priority issue despite public exploit availability. The vendor CVSS 4.0 score is 1.9, and the vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N) tells the real story: exploitation requires HIGH privileges (PR:H - an authenticated administrator who can access the Admin Settings endpoint) plus victim user interaction (UI:P), and the only impact is LOW integrity (VI:L) with zero confidentiality or availability impact. The GitHub PR diff confirms the root cause precisely: the footer label config value was rendered with Blade's unescaped |
| Exploit ScenarioDerived | A privileged administrator (or an attacker who has compromised an admin account) sets the CRM footer label config value to a string containing HTML/JavaScript, which is then stored and rendered unescaped in the admin layout footer. When another admin loads a page, the script executes in their browser session (stored XSS). A public exploit advisory (carlosalbertotuma advisory-04) documents the technique. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 27, 2026
Stored cross-site scripting in Krayin CRM (laravel-crm) up to and including version 2.2.5 lets an authenticated administrator inject arbitrary JavaScript through the Admin Settings footer label field, which is then rendered unescaped on admin layout pages for any admin who views them. The setting 'general.settings.footer.label' is output with Laravel Blade's raw {!! !!} directive in packages/Webkul/Admin/src/Resources/views/components/layouts/index.blade.php, so script content typed into that field executes in the browser of the next admin loading a page containing the footer-effectively an admin-to-admin/self-XSS scenario confined to the admin panel. Publicly available exploit code exists (a dedicated advisory write-up), but there is no KEV confirmation of active exploitation, and the assigned vector (CVSS 4.0 base 1.9; independent assessment CVSS 3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) reflects a genuinely low-priority issue despite the public proof of concept. Upgrading to 2.2.6 resolves it.
RemediationAI
Upgrade Krayin laravel-crm to version 2.2.6, the vendor-released patch (release tag https://github.com/krayin/laravel-crm/releases/tag/v2.2.6), or apply upstream commit 6dbcf75b30dbd169ee81b7e9e00368099124efeb from PR https://github.com/krayin/laravel-crm/pull/2625, which sanitizes editor-typed configuration values on save via HTMLPurifier and renders the footer through core()->sanitizeHtml() instead of raw Blade output. If upgrading is not immediately possible, the practical compensating controls are: restrict access to the Admin Settings configuration endpoint to the smallest possible set of trusted administrators (the exploit requires an authenticated high-privilege admin, so reducing that population directly reduces exposure), and manually clear or overwrite the 'general.settings.footer.label' value in the core_config table with plain text, verifying it contains no script, event-handler attributes, or javascript: URIs-with the trade-off that any custom HTML formatting previously placed in the footer will be lost. Note that the vendor's own fix indicates client-side TinyMCE filtering cannot be relied on, so disabling the editor or blocking direct POSTs to the settings endpoint without server-side sanitization is not a durable workaround. No vendor-released patch beyond 2.2.6 is required; the public exploit write-up at https://github.com/carlosalbertotuma/advisory/blob/main/advisory-04-stored-xss-via-footer.md documents the attack chain for detection and validation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Krayin CRM is an open-source Laravel-based CRM built around the Webkul package structure, where the admin UI is implemented in Blade templates and configuration values are stored and retrieved through a CoreConfigRepository and the core() helper. The flaw is CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. cross-site scripting): the footer label is a rich-text (TinyMCE/'editor' type) configuration field, but the value was persisted without server-side sanitization and then rendered with Blade's unescaped output syntax in the admin layout component, so HTML/JavaScript entered through the settings form-or posted directly to the endpoint-was stored and later emitted verbatim. The upstream fix (commit 6dbcf75b30dbd169ee81b7e9e00368099124efeb, PR #2625) adds a Sanitizer trait that runs values through HTMLPurifier with an allowlist configuration on save in CoreConfigRepository::create() for editor/TinyMCE fields, switches the footer render to core()->sanitizeHtml(...), and additionally replaces a v-html binding in the admin mail template with a v-safe-html equivalent-treating the client-side TinyMCE filtering as insufficient and establishing the server-side sanitization boundary that was missing. The CPE cpe:2.3:a:krayin:laravel-crm:*:*:*:*:*:*:*:* covers all released versions before the fix.
Know when Krayin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Requires admin privilege to write the config value (PR:H) and a victim to load the page (UI:R); stored XSS crosses into victim browser context (S:C) with low confidentiality/integrity impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in Krayin laravel-crm up to 2.2.5. Impacted is an unknown function of the file packages/Webkul/Admin/src/Resources/views/components/layouts/index.blade.php of the component Admin Settings Endpoint. Performing a manipulation of the argument general.settings.footer.label results in cross site scripting. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 2.2.6 is recommended to address this issue. The patch is named 6dbcf75b30dbd169ee81b7e9e00368099124efeb. You should upgrade the affected component.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Administrative account takeover in Krayin CRM (Laravel CRM) 2.2.4 lets unauthenticated remote attackers overwrite the pr
Blind SQL injection in Krayin CRM's leads DataGrid allows any authenticated user with leads access to exfiltrate the ent
Broken object-level authorization in Krayin CRM (Laravel CRM) through version 2.2.3 lets any authenticated user tamper w
Unauthenticated remote users can still reach the installer and admin-config-setup endpoints of Krayin CRM (laravel-crm)
Missing authentication on Krayin CRM's admin mail ingest route lets any remote, unauthenticated attacker POST crafted RF
Improper privilege management in Krayin laravel-crm up to and including 2.2.5 lets an authenticated back-office user who
An insecure direct object reference (IDOR) in Krayin laravel-crm through version 2.2.5 allows any authenticated user to
Improper access control in Krayin Laravel CRM through 2.2.5 allows an authenticated low-privilege admin user to access a
Cross-site scripting in Krayin Laravel CRM through 2.2.5 lets an authenticated user with access to the admin configurati
Stored cross-site scripting (XSS) in Krayin Laravel-CRM up to version 2.2 allows authenticated users with low privileges
Stored cross-site scripting in Krayin laravel-crm (versions up to and including 2.2.5) lets an authenticated user with a
Stored client-side template injection in Krayin CRM through 2.2.6 allows an authenticated user with rights to create or
Exploit-DB