Laravel Crm
Monthly
Incorrect authorization (CWE-863) in VentureDrake Laravel CRM before 2.4.0 allows an authenticated account that already holds user-management privileges to assign roles it is not entitled to hand out - including the 'Owner' role or a role belonging to another team - by tampering with the 'role' parameter accepted by Role::find() in UserController::store/update, and to remove cross-team users through the unscoped UserIndex Livewire delete() method. The result is privilege escalation to Owner-level control plus cross-tenant user deletion on affected installations; the CVSS v3.1 assessment is AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H (high integrity and availability impact, no confidentiality impact). The issue is fully remediated in version 2.4.0 through an AssignableRole validation rule and an explicit Owner-role guard, and no public exploit was identified at time of analysis - reachability is gated by the need for a privileged administrative account (PR:H), so risk is real but not a mass-exploitation emergency.
Missing authorization checks in VentureDrake Laravel CRM before 2.4.0 allow any authenticated user holding a low-privilege Spatie role - including read-only accounts - to modify deals, quotes, orders and invoices by invoking Livewire action methods such as delete, won, lost or reopen on components like DealIndex, or by reaching the unguarded Activities and Products routes. The flaw is rated CVSS 4.0 7.1 (High) and requires only a valid non-privileged login (PR:L), with no user interaction and no administrative rights; the integrity impact is high while confidentiality and availability are unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available in version 2.4.0.
Missing authentication on Krayin CRM's admin mail ingest route lets any remote, unauthenticated attacker POST crafted RFC 2822 messages to /admin/mail/inbound-parse and plant arbitrary emails — including forged replies stitched into existing conversation threads — in victim CRM inboxes on every release through 2.2.6. VulnCheck reports proof-of-concept exploit code (SSVC Exploitation: PoC) and the attack is fully automatable, but the issue is not listed in CISA KEV, so active in-the-wild abuse is not confirmed; the CVSS v4.0 base score is 8.8, driven by high integrity impact with no confidentiality impact and only limited availability impact.
Blind SQL injection in Krayin CRM's leads DataGrid allows any authenticated user with leads access to exfiltrate the entire database, including credential hashes, CRM records, and application configuration data. The flaw exists in LeadDataGrid.php where the rotten_lead[in] query parameter is unsafely concatenated directly into a Laravel havingRaw() call without parameterized binding, enabling time-based and boolean-based blind injection. A public exploit writeup is available (jivasecurity.com), and the vendor has released a confirmed fix in v2.2.4; no CISA KEV listing at time of analysis, but the low exploitation barrier for any authenticated user makes this an urgent upgrade priority.
Administrative account takeover in Krayin CRM (Laravel CRM) 2.2.4 lets unauthenticated remote attackers overwrite the primary admin account by POSTing to the installer's admin-config-setup endpoint with an X-Requested-With: XMLHttpRequest header that defeats the CanInstall middleware redirect. Reported by VulnCheck with a publicly available exploit, it carries a 9.3 CVSS 4.0 and grants full control over all CRM data. There is no public exploit identified as actively exploited in CISA KEV, but working exploit code exists.
Broken object-level authorization in Krayin CRM (Laravel CRM) through version 2.2.3 lets any authenticated user tamper with leads, persons, organizations, quotes, and activities belonging to other users. Because the edit, update, and destroy methods across five controllers never verify record ownership, a low-privileged account can read, modify, reassign, or delete arbitrary CRM records by manipulating the object ID. Publicly available exploit details exist (reported by VulnCheck), though the issue is not listed in CISA KEV and no EPSS score was provided.
Unauthenticated remote users can still reach the installer and admin-config-setup endpoints of Krayin CRM (laravel-crm) 2.2.4 and earlier because the CanInstall middleware and InstallerController never abort once the application has already been installed, an authorization bypass that allows installer functionality to be re-driven on a live instance. Publicly available exploit code exists (a published advisory demonstrating an unauthenticated installer bypass), though there is no confirmed active exploitation (not in CISA KEV); the assessed vector is network-reachable, no privileges, no user interaction, with low confidentiality, integrity, and availability impact. Only self-hosted deployments left network-reachable with the Installer package present are exposed, and the vendor has released a patched version.
An insecure direct object reference (IDOR) in Krayin laravel-crm through version 2.2.5 allows any authenticated user to download email attachments belonging to other mailboxes simply by supplying a different attachment ID to the admin attachment-download endpoint. Exploitation requires only a valid low-privileged account on the admin panel, causes confidentiality loss only (no modification or denial of service), and publicly available exploit code exists, which the CVSS 4.0 vector reflects via its E:P (proof-of-concept) exploit maturity rating. Vendor-released patch: 2.2.6, which enforces the mail.view permission on the download action.
Improper access control in Krayin Laravel CRM through 2.2.5 allows an authenticated low-privilege admin user to access administrative functions whose routes are missing from the ACL map, including warehouse settings left unprotected by a route-name typo. The pre-2.2.6 Bouncer middleware failed open for unmapped admin routes, so an attacker who already holds valid admin-backend credentials can invoke functions outside their intended role; publicly available exploit code exists, and upgrading to 2.2.6 fixes the issue. Impact is confined to individual unmapped admin functions rather than full system compromise, making this a moderate-severity broken-access-control flaw.
Stored cross-site scripting in Krayin CRM (laravel-crm) up to and including version 2.2.5 lets an authenticated administrator inject arbitrary JavaScript through the Admin Settings footer label field, which is then rendered unescaped on admin layout pages for any admin who views them. The setting 'general.settings.footer.label' is output with Laravel Blade's raw `{!! !!}` directive in packages/Webkul/Admin/src/Resources/views/components/layouts/index.blade.php, so script content typed into that field executes in the browser of the next admin loading a page containing the footer-effectively an admin-to-admin/self-XSS scenario confined to the admin panel. Publicly available exploit code exists (a dedicated advisory write-up), but there is no KEV confirmation of active exploitation, and the assigned vector (CVSS 4.0 base 1.9; independent assessment CVSS 3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) reflects a genuinely low-priority issue despite the public proof of concept. Upgrading to 2.2.6 resolves it.
Stored cross-site scripting in Krayin laravel-crm (versions up to and including 2.2.5) lets an authenticated user with access to the TinyMCE media-upload feature bypass the SVG sanitizer by uploading an SVG file under a non-SVG filename such as payload.png; the stored extension is derived from the file's content, so the file is retained and served as SVG while the name-based sanitizer check is skipped. The injected script then executes in the browser of any user who later views the uploaded asset, within the application's origin. Authentication with low privileges (PR:L) and passive victim interaction (UI:P) are required, impact is confined to the victim's browser context rather than server compromise, and no public exploit code was identified at time of analysis. This is a genuine but low-priority stored XSS - a related nested-configuration-field upload path stores files without SVG sanitization as well.
Cross-site scripting in Krayin Laravel CRM through 2.2.5 lets an authenticated user with access to the admin configuration/settings panel upload a crafted SVG image containing embedded script that executes when a victim later views the rendered file. Exploitation requires a valid account with configuration access plus victim interaction (the victim must view a page that renders the uploaded SVG inline), which keeps this a low-severity, low-priority issue even though it is remotely reachable; publicly available exploit code exists, and there is no confirmation of active exploitation. The vendor resolved the flaw in 2.2.6 by removing SVG from the upload mime allowlist and resolving validation rules only from trusted server-side configuration.
Improper privilege management in Krayin laravel-crm up to and including 2.2.5 lets an authenticated back-office user who can reach the Settings > Users/Roles area escalate their own privileges by manipulating the role_id argument handled in packages/Webkul/Admin/src/Http/Controllers/Settings/UserController.php. The pre-patch code applies no canManageRole() authorization check and does not block a user from editing the role assigned to their own account or from creating/updating a role carrying permissions broader than their own, so a low-privileged account can grant itself full administrative rights. Publicly available exploit code exists (a proof-of-concept advisory has been published and the issue is tracked on GitHub), while the vendor assigns a modest CVSS 4.0 score of 2.1; exploitation still requires valid credentials for a settings-capable account, so this is a targeted, post-authentication privilege-escalation risk rather than an unauthenticated compromise.
Stored client-side template injection in Krayin CRM through 2.2.6 allows an authenticated user with rights to create or edit web forms to plant Vue.js double-brace template expressions in the form description field, which the Vue template compiler renders without sanitization and which ultimately resolves to arbitrary JavaScript execution in the application origin for any user who views the crafted form. Exploitation requires an authenticated foothold (CVSS:4.0 PR:L / CVSS:3.1 PR:L) plus a separate victim passively rendering the form (UI:P / UI:R), so it is a stored, second-order attack rather than a self-contained remote exploit; impact is confined to client-side script execution in other users' sessions (SC:L/SI:L) with no direct server-side compromise. Severity is moderate - CVSS:4.0 5.1 and the independent assessment's CVSS:3.1 5.1 - and no public exploit code was identified at time of analysis; the issue was reported by VulnCheck and is documented in a public CVE disclosure repository and vendor advisory.
Stored client-side template injection in Krayin CRM through 2.2.6 lets an authenticated user who can create or edit products plant Vue.js template expressions in the product name field, which are then compiled and executed as JavaScript in the browser of any other user who opens the affected product record. Exploitation requires a valid CRM account with product create/edit rights (PR:L) and completes only passively, when a victim views the record (UI:P); impact is confined to the victim's browser and the application's origin, with no server-side compromise or availability effect. No public exploit code was identified in the available intelligence at time of analysis, and there is no evidence of confirmed active exploitation, so this is a genuine but moderate-priority finding rather than a high-severity one.
Stored client-side template injection in Krayin CRM through version 2.2.6 lets any authenticated user who can create or edit a person record plant Vue.js double-brace expressions in the name field, which the client-side Vue template compiler later evaluates in the browser of any other user who opens that record. Successful exploitation results in arbitrary JavaScript execution in the Krayin application origin, allowing theft of data or session material available to the viewing user, but it requires a low-privileged authenticated account to persist the payload and a second user to view the poisoned record, keeping the practical risk at medium severity (vendor CVSS 4.0 5.1; independent assessment CVSS 3.1 5.1). Impact is confined to the victim's browser on the CRM origin with no direct server-side code execution, and there is no public exploit identified at time of analysis and no confirmed active exploitation.
Stored client-side template injection in Krayin CRM through 2.2.6 lets an authenticated user who can create or edit leads embed Vue.js double-brace template expressions in a lead's title field, which then execute as arbitrary JavaScript in the browser of any user who opens the poisoned record. The injected expressions reach the client-side Vue template compiler, allowing prototype-chain traversal to the Function constructor and code execution in the application origin, so every subsequent viewer of the lead is affected until the record is sanitized. Exploitation requires valid CRM credentials with lead privileges plus a victim who views the record, and is confined to the browser origin with no server-side code execution; no public exploit code and no confirmed active exploitation (not listed in CISA KEV) were identified at time of analysis, and this is assessed as a moderate, not top-tier, priority.
Stored cross-site scripting (XSS) in Krayin Laravel-CRM up to version 2.2 allows authenticated users with low privileges to inject malicious scripts via the composeMail function in the Activities/Notes Module, which are then executed when other users view the content. The vulnerability requires user interaction (UI:P) but has confirmed publicly available exploit code and a vendor-released patch (commit 73ed28d466bf14787fdb86a120c656a4af270153), making it a moderate priority for deployments where multiple users interact with notes and mail features.
Incorrect authorization (CWE-863) in VentureDrake Laravel CRM before 2.4.0 allows an authenticated account that already holds user-management privileges to assign roles it is not entitled to hand out - including the 'Owner' role or a role belonging to another team - by tampering with the 'role' parameter accepted by Role::find() in UserController::store/update, and to remove cross-team users through the unscoped UserIndex Livewire delete() method. The result is privilege escalation to Owner-level control plus cross-tenant user deletion on affected installations; the CVSS v3.1 assessment is AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H (high integrity and availability impact, no confidentiality impact). The issue is fully remediated in version 2.4.0 through an AssignableRole validation rule and an explicit Owner-role guard, and no public exploit was identified at time of analysis - reachability is gated by the need for a privileged administrative account (PR:H), so risk is real but not a mass-exploitation emergency.
Missing authorization checks in VentureDrake Laravel CRM before 2.4.0 allow any authenticated user holding a low-privilege Spatie role - including read-only accounts - to modify deals, quotes, orders and invoices by invoking Livewire action methods such as delete, won, lost or reopen on components like DealIndex, or by reaching the unguarded Activities and Products routes. The flaw is rated CVSS 4.0 7.1 (High) and requires only a valid non-privileged login (PR:L), with no user interaction and no administrative rights; the integrity impact is high while confidentiality and availability are unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available in version 2.4.0.
Missing authentication on Krayin CRM's admin mail ingest route lets any remote, unauthenticated attacker POST crafted RFC 2822 messages to /admin/mail/inbound-parse and plant arbitrary emails — including forged replies stitched into existing conversation threads — in victim CRM inboxes on every release through 2.2.6. VulnCheck reports proof-of-concept exploit code (SSVC Exploitation: PoC) and the attack is fully automatable, but the issue is not listed in CISA KEV, so active in-the-wild abuse is not confirmed; the CVSS v4.0 base score is 8.8, driven by high integrity impact with no confidentiality impact and only limited availability impact.
Blind SQL injection in Krayin CRM's leads DataGrid allows any authenticated user with leads access to exfiltrate the entire database, including credential hashes, CRM records, and application configuration data. The flaw exists in LeadDataGrid.php where the rotten_lead[in] query parameter is unsafely concatenated directly into a Laravel havingRaw() call without parameterized binding, enabling time-based and boolean-based blind injection. A public exploit writeup is available (jivasecurity.com), and the vendor has released a confirmed fix in v2.2.4; no CISA KEV listing at time of analysis, but the low exploitation barrier for any authenticated user makes this an urgent upgrade priority.
Administrative account takeover in Krayin CRM (Laravel CRM) 2.2.4 lets unauthenticated remote attackers overwrite the primary admin account by POSTing to the installer's admin-config-setup endpoint with an X-Requested-With: XMLHttpRequest header that defeats the CanInstall middleware redirect. Reported by VulnCheck with a publicly available exploit, it carries a 9.3 CVSS 4.0 and grants full control over all CRM data. There is no public exploit identified as actively exploited in CISA KEV, but working exploit code exists.
Broken object-level authorization in Krayin CRM (Laravel CRM) through version 2.2.3 lets any authenticated user tamper with leads, persons, organizations, quotes, and activities belonging to other users. Because the edit, update, and destroy methods across five controllers never verify record ownership, a low-privileged account can read, modify, reassign, or delete arbitrary CRM records by manipulating the object ID. Publicly available exploit details exist (reported by VulnCheck), though the issue is not listed in CISA KEV and no EPSS score was provided.
Unauthenticated remote users can still reach the installer and admin-config-setup endpoints of Krayin CRM (laravel-crm) 2.2.4 and earlier because the CanInstall middleware and InstallerController never abort once the application has already been installed, an authorization bypass that allows installer functionality to be re-driven on a live instance. Publicly available exploit code exists (a published advisory demonstrating an unauthenticated installer bypass), though there is no confirmed active exploitation (not in CISA KEV); the assessed vector is network-reachable, no privileges, no user interaction, with low confidentiality, integrity, and availability impact. Only self-hosted deployments left network-reachable with the Installer package present are exposed, and the vendor has released a patched version.
An insecure direct object reference (IDOR) in Krayin laravel-crm through version 2.2.5 allows any authenticated user to download email attachments belonging to other mailboxes simply by supplying a different attachment ID to the admin attachment-download endpoint. Exploitation requires only a valid low-privileged account on the admin panel, causes confidentiality loss only (no modification or denial of service), and publicly available exploit code exists, which the CVSS 4.0 vector reflects via its E:P (proof-of-concept) exploit maturity rating. Vendor-released patch: 2.2.6, which enforces the mail.view permission on the download action.
Improper access control in Krayin Laravel CRM through 2.2.5 allows an authenticated low-privilege admin user to access administrative functions whose routes are missing from the ACL map, including warehouse settings left unprotected by a route-name typo. The pre-2.2.6 Bouncer middleware failed open for unmapped admin routes, so an attacker who already holds valid admin-backend credentials can invoke functions outside their intended role; publicly available exploit code exists, and upgrading to 2.2.6 fixes the issue. Impact is confined to individual unmapped admin functions rather than full system compromise, making this a moderate-severity broken-access-control flaw.
Stored cross-site scripting in Krayin CRM (laravel-crm) up to and including version 2.2.5 lets an authenticated administrator inject arbitrary JavaScript through the Admin Settings footer label field, which is then rendered unescaped on admin layout pages for any admin who views them. The setting 'general.settings.footer.label' is output with Laravel Blade's raw `{!! !!}` directive in packages/Webkul/Admin/src/Resources/views/components/layouts/index.blade.php, so script content typed into that field executes in the browser of the next admin loading a page containing the footer-effectively an admin-to-admin/self-XSS scenario confined to the admin panel. Publicly available exploit code exists (a dedicated advisory write-up), but there is no KEV confirmation of active exploitation, and the assigned vector (CVSS 4.0 base 1.9; independent assessment CVSS 3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) reflects a genuinely low-priority issue despite the public proof of concept. Upgrading to 2.2.6 resolves it.
Stored cross-site scripting in Krayin laravel-crm (versions up to and including 2.2.5) lets an authenticated user with access to the TinyMCE media-upload feature bypass the SVG sanitizer by uploading an SVG file under a non-SVG filename such as payload.png; the stored extension is derived from the file's content, so the file is retained and served as SVG while the name-based sanitizer check is skipped. The injected script then executes in the browser of any user who later views the uploaded asset, within the application's origin. Authentication with low privileges (PR:L) and passive victim interaction (UI:P) are required, impact is confined to the victim's browser context rather than server compromise, and no public exploit code was identified at time of analysis. This is a genuine but low-priority stored XSS - a related nested-configuration-field upload path stores files without SVG sanitization as well.
Cross-site scripting in Krayin Laravel CRM through 2.2.5 lets an authenticated user with access to the admin configuration/settings panel upload a crafted SVG image containing embedded script that executes when a victim later views the rendered file. Exploitation requires a valid account with configuration access plus victim interaction (the victim must view a page that renders the uploaded SVG inline), which keeps this a low-severity, low-priority issue even though it is remotely reachable; publicly available exploit code exists, and there is no confirmation of active exploitation. The vendor resolved the flaw in 2.2.6 by removing SVG from the upload mime allowlist and resolving validation rules only from trusted server-side configuration.
Improper privilege management in Krayin laravel-crm up to and including 2.2.5 lets an authenticated back-office user who can reach the Settings > Users/Roles area escalate their own privileges by manipulating the role_id argument handled in packages/Webkul/Admin/src/Http/Controllers/Settings/UserController.php. The pre-patch code applies no canManageRole() authorization check and does not block a user from editing the role assigned to their own account or from creating/updating a role carrying permissions broader than their own, so a low-privileged account can grant itself full administrative rights. Publicly available exploit code exists (a proof-of-concept advisory has been published and the issue is tracked on GitHub), while the vendor assigns a modest CVSS 4.0 score of 2.1; exploitation still requires valid credentials for a settings-capable account, so this is a targeted, post-authentication privilege-escalation risk rather than an unauthenticated compromise.
Stored client-side template injection in Krayin CRM through 2.2.6 allows an authenticated user with rights to create or edit web forms to plant Vue.js double-brace template expressions in the form description field, which the Vue template compiler renders without sanitization and which ultimately resolves to arbitrary JavaScript execution in the application origin for any user who views the crafted form. Exploitation requires an authenticated foothold (CVSS:4.0 PR:L / CVSS:3.1 PR:L) plus a separate victim passively rendering the form (UI:P / UI:R), so it is a stored, second-order attack rather than a self-contained remote exploit; impact is confined to client-side script execution in other users' sessions (SC:L/SI:L) with no direct server-side compromise. Severity is moderate - CVSS:4.0 5.1 and the independent assessment's CVSS:3.1 5.1 - and no public exploit code was identified at time of analysis; the issue was reported by VulnCheck and is documented in a public CVE disclosure repository and vendor advisory.
Stored client-side template injection in Krayin CRM through 2.2.6 lets an authenticated user who can create or edit products plant Vue.js template expressions in the product name field, which are then compiled and executed as JavaScript in the browser of any other user who opens the affected product record. Exploitation requires a valid CRM account with product create/edit rights (PR:L) and completes only passively, when a victim views the record (UI:P); impact is confined to the victim's browser and the application's origin, with no server-side compromise or availability effect. No public exploit code was identified in the available intelligence at time of analysis, and there is no evidence of confirmed active exploitation, so this is a genuine but moderate-priority finding rather than a high-severity one.
Stored client-side template injection in Krayin CRM through version 2.2.6 lets any authenticated user who can create or edit a person record plant Vue.js double-brace expressions in the name field, which the client-side Vue template compiler later evaluates in the browser of any other user who opens that record. Successful exploitation results in arbitrary JavaScript execution in the Krayin application origin, allowing theft of data or session material available to the viewing user, but it requires a low-privileged authenticated account to persist the payload and a second user to view the poisoned record, keeping the practical risk at medium severity (vendor CVSS 4.0 5.1; independent assessment CVSS 3.1 5.1). Impact is confined to the victim's browser on the CRM origin with no direct server-side code execution, and there is no public exploit identified at time of analysis and no confirmed active exploitation.
Stored client-side template injection in Krayin CRM through 2.2.6 lets an authenticated user who can create or edit leads embed Vue.js double-brace template expressions in a lead's title field, which then execute as arbitrary JavaScript in the browser of any user who opens the poisoned record. The injected expressions reach the client-side Vue template compiler, allowing prototype-chain traversal to the Function constructor and code execution in the application origin, so every subsequent viewer of the lead is affected until the record is sanitized. Exploitation requires valid CRM credentials with lead privileges plus a victim who views the record, and is confined to the browser origin with no server-side code execution; no public exploit code and no confirmed active exploitation (not listed in CISA KEV) were identified at time of analysis, and this is assessed as a moderate, not top-tier, priority.
Stored cross-site scripting (XSS) in Krayin Laravel-CRM up to version 2.2 allows authenticated users with low privileges to inject malicious scripts via the composeMail function in the Activities/Notes Module, which are then executed when other users view the content. The vulnerability requires user interaction (UI:P) but has confirmed publicly available exploit code and a vendor-released patch (commit 73ed28d466bf14787fdb86a120c656a4af270153), making it a moderate priority for deployments where multiple users interact with notes and mail features.