Login Request a demo
Low severity · published Apr 2, 2026
CVE-2026-5370
krayin laravel-crm Activities Module/Notes inbox.spec.ts composeMail cross site scripting
3.5
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was identified in krayin laravel-crm up to 2.2. Impacted is the function composeMail of the file packages/Webkul/Admin/tests/e2e-pw/tests/mail/inbox.spec.ts of the component Activities Module/Notes Module. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is 73ed28d466bf14787fdb86a120c656a4af270153. To fix this issue, it is recommended to deploy a patch.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LA
laravel-crm · krayin
2.0; 2.1; 2.2 · source: vendor
Affected product
LA
laravel-crm
krayin
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-5370
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-5370
github.com
https://github.com/krayin/laravel-crm/
github.com
https://github.com/krayin/laravel-crm/commit/73ed28d466bf14787fdb86a120c656a4af270153
github.com
https://github.com/krayin/laravel-crm/issues/2419
github.com
https://github.com/krayin/laravel-crm/pull/2466
vuldb.com
https://vuldb.com/submit/781666
vuldb.com
https://vuldb.com/vuln/354756
More from laravel-crm
9.8
CVE-2026-41452
Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup
8.8
CVE-2026-41453
Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter
8.8
CVE-2026-61460
Krayin CRM Insecure Direct Object Reference via Controllers
8.2
CVE-2026-90944
Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse
7.3
CVE-2026-100885
Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization