{"schema_version":"1","data":[{"id":4966,"advisory_id":"4daeefc8-ce19-4378-bb37-aeb3778f6211","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100885","source_published_at":"2026-09-27T22:45:19.897+00:00","published_at":"2026-10-24T22:00:55.849789+00:00","extraction_method":"structured","technologies":["core-cve","laravel-crm"],"cve_ids":["CVE-2026-100885"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization","summary":"A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 2.2.5 mitigates this issue. The patch is identified as 89f2916b6a46ff91bd1999ce38158fa0de8b9490. Upgrading the affected component is recommended.","evidence":"cve:CVE-2026-100885","products":[{"name":{"value":"laravel-crm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100885","aliases":["CVE-2026-100885"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:krayin:laravel-crm:*:*:*:*:*:*:*:*"],"vendor":"Krayin","modules":["admin-config-setup API Endpoint"],"product":"laravel-crm","versions":[{"status":"affected","version":"2.2.0"},{"status":"affected","version":"2.2.1"},{"status":"affected","version":"2.2.2"},{"status":"affected","version":"2.2.3"},{"status":"affected","version":"2.2.4"},{"status":"unaffected","version":"2.2.5"}]}],"modified":"2026-09-30T22:15:32.020Z","provider":"cve","references":["https://vuldb.com/vuln/410815","https://vuldb.com/vuln/410815/cti","https://vuldb.com/cve/CVE-2026-100885","https://vuldb.com/submit/916597","https://github.com/carlosalbertotuma/advisory/blob/main/advisory-07-Unauthenticated-InstallerBypass.md","https://github.com/krayin/laravel-crm/pull/2614","https://github.com/krayin/laravel-crm/commit/89f2916b6a46ff91bd1999ce38158fa0de8b9490","https://github.com/krayin/laravel-crm/releases/tag/v2.2.5","https://github.com/krayin/laravel-crm/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100885","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T22:15:22.727657Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T22:15:32.020Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-09-27T22:45:19.897Z"}}},"related_cves":[{"value":"CVE-2026-100885","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":4964,"advisory_id":"87ae4c2b-abc1-4860-bed7-ceb14f9d2c36","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100882","source_published_at":"2026-09-27T22:00:13.969+00:00","published_at":"2026-10-24T22:00:54.684722+00:00","extraction_method":"structured","technologies":["core-cve","laravel-crm"],"cve_ids":["CVE-2026-100882"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Krayin laravel-crm Admin Settings Endpoint index.blade.php cross site scripting","summary":"A vulnerability was detected in Krayin laravel-crm up to 2.2.5. Impacted is an unknown function of the file packages/Webkul/Admin/src/Resources/views/components/layouts/index.blade.php of the component Admin Settings Endpoint. Performing a manipulation of the argument general.settings.footer.label results in cross site scripting. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 2.2.6 is recommended to address this issue. The patch is named 6dbcf75b30dbd169ee81b7e9e00368099124efeb. You should upgrade the affected component.","evidence":"cve:CVE-2026-100882","products":[{"name":{"value":"laravel-crm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100882","aliases":["CVE-2026-100882"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":4.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":2.4,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":2.4,"baseSeverity":"LOW","vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":3.3,"vectorString":"AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:OF/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:krayin:laravel-crm:*:*:*:*:*:*:*:*"],"vendor":"Krayin","modules":["Admin Settings Endpoint"],"product":"laravel-crm","versions":[{"status":"affected","version":"2.2.0"},{"status":"affected","version":"2.2.1"},{"status":"affected","version":"2.2.2"},{"status":"affected","version":"2.2.3"},{"status":"affected","version":"2.2.4"},{"status":"affected","version":"2.2.5"},{"status":"unaffected","version":"2.2.6"}]}],"modified":"2026-09-30T22:14:49.571Z","provider":"cve","references":["https://vuldb.com/vuln/410812","https://vuldb.com/vuln/410812/cti","https://vuldb.com/cve/CVE-2026-100882","https://vuldb.com/submit/916088","https://github.com/krayin/laravel-crm/issues/2622","https://github.com/krayin/laravel-crm/pull/2625","https://github.com/carlosalbertotuma/advisory/blob/main/advisory-04-stored-xss-via-footer.md","https://github.com/krayin/laravel-crm/commit/6dbcf75b30dbd169ee81b7e9e00368099124efeb","https://github.com/krayin/laravel-crm/releases/tag/v2.2.6","https://github.com/krayin/laravel-crm/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100882","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T22:14:40.963385Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T22:14:49.571Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-09-27T22:00:13.969Z"}}},"related_cves":[{"value":"CVE-2026-100882","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":4754,"advisory_id":"2837f299-4a33-4679-8c7c-93690b096267","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-48541","source_published_at":"2026-09-24T19:31:13.12+00:00","published_at":"2026-10-24T21:56:49.952639+00:00","extraction_method":"structured","technologies":["core-cve","laravel-crm"],"cve_ids":["CVE-2026-48541"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Krayin CRM 2.2.6 Stored Template Injection XSS via Contact Name Field","summary":"Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected person record.","evidence":"cve:CVE-2026-48541","products":[{"name":{"value":"laravel-crm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-48541","aliases":["CVE-2026-48541"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/krayin/laravel-crm","vendor":"krayin","product":"laravel-crm","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"2.2.6"}],"packageURL":"pkg:github/krayin/laravel-crm","defaultStatus":"unknown"}],"modified":"2026-09-30T17:29:32.519Z","provider":"cve","references":["https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541","https://www.vulncheck.com/advisories/krayin-crm-stored-template-injection-xss-via-contact-name-field"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-48541","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T15:43:46.646473Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T17:29:32.519Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T19:31:13.120Z"}}},"related_cves":[{"value":"CVE-2026-48541","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":4097,"advisory_id":"1bd53f43-e66e-4c58-be32-3f24e3bf8e8a","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97896","source_published_at":"2026-09-25T18:30:19.532+00:00","published_at":"2026-10-24T21:45:51.487742+00:00","extraction_method":"structured","technologies":["core-cve","laravel-crm"],"cve_ids":["CVE-2026-97896"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"krayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting","summary":"A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationForm::rules of the file packages/Webkul/Admin/src/Http/Requests/ConfigurationForm.php of the component Upload Functionality. The manipulation leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. Upgrading to version 2.2.6 is able to resolve this issue. The identifier of the patch is b9836530ec9f5ef0f51653bb0cbbc47ef7184f51. It is advisable to upgrade the affected component.","evidence":"cve:CVE-2026-97896","products":[{"name":{"value":"laravel-crm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-97896","aliases":["CVE-2026-97896"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":3.5,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":3.5,"baseSeverity":"LOW","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:krayin:laravel-crm:*:*:*:*:*:*:*:*"],"vendor":"krayin","modules":["Upload Functionality"],"product":"laravel-crm","versions":[{"status":"affected","version":"2.2.0"},{"status":"affected","version":"2.2.1"},{"status":"affected","version":"2.2.2"},{"status":"affected","version":"2.2.3"},{"status":"affected","version":"2.2.4"},{"status":"affected","version":"2.2.5"},{"status":"unaffected","version":"2.2.6"}]}],"modified":"2026-09-30T00:01:55.385Z","provider":"cve","references":["https://vuldb.com/vuln/409908","https://vuldb.com/vuln/409908/cti","https://vuldb.com/cve/CVE-2026-97896","https://vuldb.com/submit/915399","https://github.com/krayin/laravel-crm/issues/2617","https://github.com/krayin/laravel-crm/pull/2620","https://github.com/carlosalbertotuma/advisory/blob/main/advisory-02-config-upload-xss.md","https://github.com/krayin/laravel-crm/commit/b9836530ec9f5ef0f51653bb0cbbc47ef7184f51","https://github.com/krayin/laravel-crm/releases/tag/v2.2.6","https://github.com/krayin/laravel-crm/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97896","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-30T00:01:46.346618Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T00:01:55.385Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-09-25T18:30:19.532Z"}}},"related_cves":[{"value":"CVE-2026-97896","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":3891,"advisory_id":"2606cd44-3b2d-4dab-a2f1-1854e3fef198","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97897","source_published_at":"2026-09-25T18:45:09.156+00:00","published_at":"2026-10-24T21:42:51.559068+00:00","extraction_method":"structured","technologies":["core-cve","laravel-crm"],"cve_ids":["CVE-2026-97897"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting","summary":"A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 is capable of addressing this issue. The patch is identified as 734aa10ae6c2ffa4c96c8869a89aa66940e4d345. You should upgrade the affected component.","evidence":"cve:CVE-2026-97897","products":[{"name":{"value":"laravel-crm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-97897","aliases":["CVE-2026-97897"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X"}},{"cvssV3_1":{"version":"3.1","baseScore":3.5,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":3.5,"baseSeverity":"LOW","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:OF/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:krayin:laravel-crm:*:*:*:*:*:*:*:*"],"vendor":"Krayin","modules":["TinyMCE Media Upload"],"product":"laravel-crm","versions":[{"status":"affected","version":"2.2.0"},{"status":"affected","version":"2.2.1"},{"status":"affected","version":"2.2.2"},{"status":"affected","version":"2.2.3"},{"status":"affected","version":"2.2.4"},{"status":"affected","version":"2.2.5"},{"status":"unaffected","version":"2.2.6"}]}],"modified":"2026-09-29T17:54:15.390Z","provider":"cve","references":["https://vuldb.com/vuln/409909","https://vuldb.com/vuln/409909/cti","https://vuldb.com/cve/CVE-2026-97897","https://vuldb.com/submit/915413","https://github.com/carlosalbertotuma/advisory/blob/main/advisory-03-stored-xss-tinymce-media-upload.md","https://github.com/krayin/laravel-crm/pull/2639","https://github.com/krayin/laravel-crm/commit/734aa10ae6c2ffa4c96c8869a89aa66940e4d345","https://github.com/krayin/laravel-crm/releases/tag/v2.2.6","https://github.com/krayin/laravel-crm/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97897","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T17:52:12.671880Z"}}}],"references":[{"url":"https://github.com/carlosalbertotuma/advisory/blob/main/advisory-03-stored-xss-tinymce-media-upload.md","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T17:54:15.390Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-09-25T18:45:09.156Z"}}},"related_cves":[{"value":"CVE-2026-97897","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":3390,"advisory_id":"781017b1-f9c1-43e2-98b3-f0089d9f2e94","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-48542","source_published_at":"2026-09-24T19:31:52.975+00:00","published_at":"2026-10-24T21:34:15.437708+00:00","extraction_method":"structured","technologies":["core-cve","laravel-crm"],"cve_ids":["CVE-2026-48542"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Krayin CRM 2.2.6 Stored Template Injection XSS via Product Name Field","summary":"Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the product name field. Attackers can craft a product name containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected product record.","evidence":"cve:CVE-2026-48542","products":[{"name":{"value":"laravel-crm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-48542","aliases":["CVE-2026-48542"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/krayin/laravel-crm","vendor":"krayin","product":"laravel-crm","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"2.2.6"}],"packageURL":"pkg:github/krayin/laravel-crm","defaultStatus":"unknown"}],"modified":"2026-09-29T03:10:37.689Z","provider":"cve","references":["https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541","https://www.vulncheck.com/advisories/krayin-crm-stored-template-injection-xss-via-product-name-field"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-48542","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T03:10:16.233438Z"}}}],"references":[{"url":"https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T03:10:37.689Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T19:31:52.975Z"}}},"related_cves":[{"value":"CVE-2026-48542","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":3064,"advisory_id":"d360e029-bf12-493a-851f-925519d76c08","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100883","source_published_at":"2026-09-27T22:15:08.551+00:00","published_at":"2026-10-24T21:28:58.736982+00:00","extraction_method":"structured","technologies":["core-cve","laravel-crm"],"cve_ids":["CVE-2026-100883"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Krayin laravel-crm acl.php access control","summary":"A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file packages/Webkul/Admin/src/Config/acl.php. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been published and may be used. Upgrading to version 2.2.6 is sufficient to fix this issue. This patch is called a399404a388d8ad2700a01349d0d98069c8e85a4. The affected component should be upgraded.","evidence":"cve:CVE-2026-100883","products":[{"name":{"value":"laravel-crm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100883","aliases":["CVE-2026-100883"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:krayin:laravel-crm:*:*:*:*:*:*:*:*"],"vendor":"Krayin","product":"laravel-crm","versions":[{"status":"affected","version":"2.2.0"},{"status":"affected","version":"2.2.1"},{"status":"affected","version":"2.2.2"},{"status":"affected","version":"2.2.3"},{"status":"affected","version":"2.2.4"},{"status":"affected","version":"2.2.5"},{"status":"unaffected","version":"2.2.6"}]}],"modified":"2026-09-28T13:19:18.207Z","provider":"cve","references":["https://vuldb.com/vuln/410813","https://vuldb.com/vuln/410813/cti","https://vuldb.com/cve/CVE-2026-100883","https://vuldb.com/submit/916128","https://github.com/krayin/laravel-crm/issues/2623","https://github.com/krayin/laravel-crm/pull/2626","https://github.com/carlosalbertotuma/advisory/blob/main/advisory-05-Missing-Function-Level%20Authorization.md","https://github.com/krayin/laravel-crm/commit/a399404a388d8ad2700a01349d0d98069c8e85a4","https://github.com/krayin/laravel-crm/releases/tag/v2.2.6","https://github.com/krayin/laravel-crm/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100883","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T13:17:44.298727Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T13:19:18.207Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-09-27T22:15:08.551Z"}}},"related_cves":[{"value":"CVE-2026-100883","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":3045,"advisory_id":"04c8dfd0-9db7-40cb-8ffd-a80b9fdb31f5","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100884","source_published_at":"2026-09-27T22:30:14.286+00:00","published_at":"2026-10-24T21:28:47.295947+00:00","extraction_method":"structured","technologies":["core-cve","laravel-crm"],"cve_ids":["CVE-2026-100884"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Krayin laravel-crm attachment-download Endpoint acl.php resource injection","summary":"A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download of the file packages/Webkul/Admin/src/Config/acl.php of the component attachment-download Endpoint. The manipulation of the argument ID leads to improper control of resource identifiers. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.2.6 is sufficient to resolve this issue. The identifier of the patch is 13d6988cda8d69ece45ee1890effc90a7f21cdc1. It is suggested to upgrade the affected component.","evidence":"cve:CVE-2026-100884","products":[{"name":{"value":"laravel-crm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100884","aliases":["CVE-2026-100884"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:krayin:laravel-crm:*:*:*:*:*:*:*:*"],"vendor":"Krayin","modules":["attachment-download Endpoint"],"product":"laravel-crm","versions":[{"status":"affected","version":"2.2.0"},{"status":"affected","version":"2.2.1"},{"status":"affected","version":"2.2.2"},{"status":"affected","version":"2.2.3"},{"status":"affected","version":"2.2.4"},{"status":"affected","version":"2.2.5"},{"status":"unaffected","version":"2.2.6"}]}],"modified":"2026-09-28T12:54:26.833Z","provider":"cve","references":["https://vuldb.com/vuln/410814","https://vuldb.com/vuln/410814/cti","https://vuldb.com/cve/CVE-2026-100884","https://vuldb.com/submit/916218","https://github.com/krayin/laravel-crm/issues/2624","https://github.com/krayin/laravel-crm/pull/2627","https://github.com/carlosalbertotuma/advisory/blob/main/advisory-06-IDOR-Email-Attachment%20Download.md","https://github.com/krayin/laravel-crm/commit/13d6988cda8d69ece45ee1890effc90a7f21cdc1","https://github.com/krayin/laravel-crm/releases/tag/v2.2.6","https://github.com/krayin/laravel-crm/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100884","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T12:54:15.392910Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T12:54:26.833Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-09-27T22:30:14.286Z"}}},"related_cves":[{"value":"CVE-2026-100884","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":2243,"advisory_id":"d7728c4e-c6d5-47d7-8c14-84bd31c47dd9","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97895","source_published_at":"2026-09-25T18:15:17.276+00:00","published_at":"2026-10-24T21:15:36.944798+00:00","extraction_method":"structured","technologies":["core-cve","laravel-crm"],"cve_ids":["CVE-2026-97895"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"krayin laravel-crm User Management UserController.php privileges management","summary":"A vulnerability was determined in krayin laravel-crm up to 2.2.5. This affects an unknown part of the file packages/Webkul/Admin/src/Http/Controllers/Settings/UserController.php of the component User Management. Executing a manipulation of the argument role_id can lead to improper privilege management. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.2.6 is able to mitigate this issue. This patch is called 5469d70336fbb25e8e513683e82b32982ce8aa82. Upgrading the affected component is advised.","evidence":"cve:CVE-2026-97895","products":[{"name":{"value":"laravel-crm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-97895","aliases":["CVE-2026-97895"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:krayin:laravel-crm:*:*:*:*:*:*:*:*"],"vendor":"krayin","modules":["User Management"],"product":"laravel-crm","versions":[{"status":"affected","version":"2.2.0"},{"status":"affected","version":"2.2.1"},{"status":"affected","version":"2.2.2"},{"status":"affected","version":"2.2.3"},{"status":"affected","version":"2.2.4"},{"status":"affected","version":"2.2.5"},{"status":"unaffected","version":"2.2.6"}]}],"modified":"2026-09-25T18:40:39.301Z","provider":"cve","references":["https://vuldb.com/vuln/409907","https://vuldb.com/vuln/409907/cti","https://vuldb.com/cve/CVE-2026-97895","https://vuldb.com/submit/915369","https://github.com/krayin/laravel-crm/issues/2616","https://github.com/krayin/laravel-crm/pull/2621","https://github.com/carlosalbertotuma/advisory/blob/main/advisory-01-privesc.md","https://github.com/krayin/laravel-crm/commit/5469d70336fbb25e8e513683e82b32982ce8aa82","https://github.com/krayin/laravel-crm/releases/tag/v2.2.6","https://github.com/krayin/laravel-crm/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97895","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T18:40:31.758418Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T18:40:39.301Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-09-25T18:15:17.276Z"}}},"related_cves":[{"value":"CVE-2026-97895","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":2197,"advisory_id":"9b55a036-65cc-4004-9db9-f4b098c4054d","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-48543","source_published_at":"2026-09-24T19:33:02.937+00:00","published_at":"2026-10-24T21:13:58.31947+00:00","extraction_method":"structured","technologies":["core-cve","laravel-crm"],"cve_ids":["CVE-2026-48543"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Krayin CRM 2.2.6 Stored Template Injection XSS via Web Form Description","summary":"Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form description containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected web form.","evidence":"cve:CVE-2026-48543","products":[{"name":{"value":"laravel-crm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-48543","aliases":["CVE-2026-48543"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/krayin/laravel-crm","vendor":"krayin","product":"laravel-crm","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"2.2.6"}],"packageURL":"pkg:github/krayin/laravel-crm","defaultStatus":"unknown"}],"modified":"2026-09-25T17:15:19.694Z","provider":"cve","references":["https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541","https://www.vulncheck.com/advisories/krayin-crm-stored-template-injection-xss-via-web-form-description"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-48543","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T17:13:09.686517Z"}}}],"references":[{"url":"https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T17:15:19.694Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T19:33:02.937Z"}}},"related_cves":[{"value":"CVE-2026-48543","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":1875,"advisory_id":"e43205c4-950b-4369-bb9e-33051fc1f386","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-48540","source_published_at":"2026-09-24T19:28:00.37+00:00","published_at":"2026-10-24T21:08:45.879384+00:00","extraction_method":"structured","technologies":["core-cve","laravel-crm"],"cve_ids":["CVE-2026-48540"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Krayin CRM 2.2.6 Stored Template Injection XSS via Lead Title","summary":"Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected lead record.","evidence":"cve:CVE-2026-48540","products":[{"name":{"value":"laravel-crm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-48540","aliases":["CVE-2026-48540"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/krayin/laravel-crm","vendor":"krayin","product":"laravel-crm","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"2.2.6"}],"packageURL":"pkg:github/krayin/laravel-crm","defaultStatus":"unknown"}],"modified":"2026-09-24T19:35:25.530Z","provider":"cve","references":["https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48540","https://www.vulncheck.com/advisories/krayin-crm-stored-template-injection-xss-via-lead-title"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-48540","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T19:35:00.774527Z"}}}],"references":[{"url":"https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48540","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T19:35:25.530Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T19:28:00.370Z"}}},"related_cves":[{"value":"CVE-2026-48540","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":1644,"advisory_id":"2d744287-b0fb-41a4-8d44-c1f0621161bf","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-90944","source_published_at":"2026-09-14T17:52:05.5+00:00","published_at":"2026-10-24T21:05:28.345787+00:00","extraction_method":"structured","technologies":["core-cve","laravel-crm"],"cve_ids":["CVE-2026-90944"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse","summary":"Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with any subject and body, including replies to existing conversation threads.","evidence":"cve:CVE-2026-90944","products":[{"name":{"value":"laravel-crm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-90944","aliases":["CVE-2026-90944"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/krayin/laravel-crm","vendor":"krayin","product":"laravel-crm","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"2.2.6"}],"packageURL":"pkg:composer/krayin/laravel-crm","defaultStatus":"unaffected"}],"modified":"2026-09-24T14:22:04.713Z","provider":"cve","references":["https://github.com/krayin/laravel-crm/issues/2560","https://github.com/krayin/laravel-crm","https://github.com/krayin/laravel-crm/blob/v2.2.6/packages/Webkul/Admin/src/Routes/Admin/mail-routes.php","https://github.com/krayin/laravel-crm/blob/v2.2.6/bootstrap/app.php","https://www.vulncheck.com/advisories/krayin-crm-through-2.2.6-unauthenticated-email-injection-via-inbound-parse"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-90944","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-14T20:22:34.525295Z"}}}],"references":[{"url":"https://github.com/krayin/laravel-crm/issues/2560","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-14T20:22:41.001Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:22:04.713Z"}}},"related_cves":[{"value":"CVE-2026-90944","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}}],"next_after":4966,"next_before":1644}