LA
Product
laravel-crm
19
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 1High 5Medium 8Low 5
Watch
Add laravel-crm to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-41452 | 9.8 | Aug 3 | Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup Affected: through 2.2.0; 2.2.4 |
| CVE-2026-41453 | 8.8 | Aug 3 | Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter Affected: before 2.2.4 |
| CVE-2026-61460 | 8.8 | Jul 10 | Krayin CRM Insecure Direct Object Reference via Controllers Affected: through 2.2.3 |
| CVE-2026-90944 | 8.2 | Sep 14 | Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse Affected: through 2.2.6 |
| CVE-2026-100885 | 7.3 | Sep 27 | Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization Affected: 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4 |
| CVE-2026-112287 | 7.1 | Oct 19 | Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module Affected: before 2.2.7 |
| CVE-2026-112286 | 6.5 | Oct 19 | Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints Affected: before 2.2.7 |
| CVE-2026-100883 | 6.3 | Sep 27 | Krayin laravel-crm acl.php access control Affected: 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.2.5 |
| CVE-2026-97895 | 6.3 | Sep 25 | krayin laravel-crm User Management UserController.php privileges management Affected: 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.2.5 |
| CVE-2026-48543 | 5.4 | Sep 24 | Krayin CRM 2.2.6 Stored Template Injection XSS via Web Form Description Affected: through 2.2.6 |
| CVE-2026-48542 | 5.4 | Sep 24 | Krayin CRM 2.2.6 Stored Template Injection XSS via Product Name Field Affected: through 2.2.6 |
| CVE-2026-48541 | 5.4 | Sep 24 | Krayin CRM 2.2.6 Stored Template Injection XSS via Contact Name Field Affected: through 2.2.6 |
| CVE-2026-48540 | 5.4 | Sep 24 | Krayin CRM 2.2.6 Stored Template Injection XSS via Lead Title Affected: through 2.2.6 |
| CVE-2026-100884 | 4.3 | Sep 27 | Krayin laravel-crm attachment-download Endpoint acl.php resource injection Affected: 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.2.5 |
| CVE-2026-97897 | 3.5 | Sep 25 | Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting Affected: 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.2.5 |
| CVE-2026-97896 | 3.5 | Sep 25 | krayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting Affected: 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.2.5 |
| CVE-2026-5370 | 3.5 | Apr 2 | krayin laravel-crm Activities Module/Notes inbox.spec.ts composeMail cross site scripting Affected: 2.0; 2.1; 2.2 |
| CVE-2026-112288 | 3.3 | Oct 19 | Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding Affected: 2.2.5 before 2.2.7 |
| CVE-2026-100882 | 2.4 | Sep 27 | Krayin laravel-crm Admin Settings Endpoint index.blade.php cross site scripting Affected: 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.2.5 |
Showing 19