KR
Vendor
krayin
19
CVEs
0
On KEV
3
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-112288 | LA laravel-crm krayin | 3.3 | Oct 19 | Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding |
| CVE-2026-112287 | LA laravel-crm krayin | 7.1 | Oct 19 | Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module |
| CVE-2026-112286 | LA laravel-crm krayin | 6.5 | Oct 19 | Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints |
| CVE-2026-100885 | LA laravel-crm Krayin | 7.3 | Sep 27 | Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization |
| CVE-2026-100884 | LA laravel-crm Krayin | 4.3 | Sep 27 | Krayin laravel-crm attachment-download Endpoint acl.php resource injection |
| CVE-2026-100883 | LA laravel-crm Krayin | 6.3 | Sep 27 | Krayin laravel-crm acl.php access control |
| CVE-2026-100882 | LA laravel-crm Krayin | 2.4 | Sep 27 | Krayin laravel-crm Admin Settings Endpoint index.blade.php cross site scripting |
| CVE-2026-97897 | LA laravel-crm Krayin | 3.5 | Sep 25 | Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting |
| CVE-2026-97896 | LA laravel-crm krayin | 3.5 | Sep 25 | krayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting |
| CVE-2026-97895 | LA laravel-crm krayin | 6.3 | Sep 25 | krayin laravel-crm User Management UserController.php privileges management |
| CVE-2026-48543 | LA laravel-crm krayin | 5.4 | Sep 24 | Krayin CRM 2.2.6 Stored Template Injection XSS via Web Form Description |
| CVE-2026-48542 | LA laravel-crm krayin | 5.4 | Sep 24 | Krayin CRM 2.2.6 Stored Template Injection XSS via Product Name Field |
| CVE-2026-48541 | LA laravel-crm krayin | 5.4 | Sep 24 | Krayin CRM 2.2.6 Stored Template Injection XSS via Contact Name Field |
| CVE-2026-48540 | LA laravel-crm krayin | 5.4 | Sep 24 | Krayin CRM 2.2.6 Stored Template Injection XSS via Lead Title |
| CVE-2026-90944 | LA laravel-crm krayin | 8.2 | Sep 14 | Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse |
| CVE-2026-41453 | LA laravel-crm krayin | 8.8 | Aug 3 | Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter |
| CVE-2026-41452 | LA laravel-crm krayin | 9.8 | Aug 3 | Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup |
| CVE-2026-61460 | LA laravel-crm krayin | 8.8 | Jul 10 | Krayin CRM Insecure Direct Object Reference via Controllers |
| CVE-2026-5370 | LA laravel-crm krayin | 3.5 | Apr 2 | krayin laravel-crm Activities Module/Notes inbox.spec.ts composeMail cross site scripting |