Medium severity · published Sep 24, 2026
CVE-2026-48540
Krayin CRM 2.2.6 Stored Template Injection XSS via Lead Title
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected lead record.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LA
laravel-crm · krayin
through 2.2.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-48540
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-48540
github.com
https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48540
www.vulncheck.com
https://www.vulncheck.com/advisories/krayin-crm-stored-template-injection-xss-via-lead-title
More from laravel-crm
9.8
CVE-2026-41452
Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup
8.8
CVE-2026-41453
Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter
8.8
CVE-2026-61460
Krayin CRM Insecure Direct Object Reference via Controllers
8.2
CVE-2026-90944
Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse
7.3
CVE-2026-100885
Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization