Low severity · published Sep 25, 2026
CVE-2026-97896
krayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting
3.5
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationForm::rules of the file packages/Webkul/Admin/src/Http/Requests/ConfigurationForm.php of the component Upload Functionality. The manipulation leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. Upgrading to version 2.2.6 is able to resolve this issue. The identifier of the patch is b9836530ec9f5ef0f51653bb0cbbc47ef7184f51. It is advisable to upgrade the affected component.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LA
laravel-crm · krayin
2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.2.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-97896
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-97896
vdb-entry
https://vuldb.com/vuln/409908
signature
https://vuldb.com/vuln/409908/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-97896
third-party-advisory
https://vuldb.com/submit/915399
issue-tracking
https://github.com/krayin/laravel-crm/issues/2617
issue-tracking
https://github.com/krayin/laravel-crm/pull/2620
More from laravel-crm
9.8
CVE-2026-41452
Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup
8.8
CVE-2026-41453
Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter
8.8
CVE-2026-61460
Krayin CRM Insecure Direct Object Reference via Controllers
8.2
CVE-2026-90944
Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse
7.3
CVE-2026-100885
Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization