- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 9 · 6 high, 2 medium
- Registry
- Packagist
Advisories 9
- CVE-2026-36341Medium 5.4
Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5.
Affected: from 2.1.5, fixed in 2.1.6.
- CVE-2026-36340High 8.1
An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function
Affected: from 2.1.5, fixed in 2.1.6.
- CVE-2026-38532High 8.1
A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows…
Affected: through 2.2.0.
- CVE-2026-38530High 8.1
A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows…
Affected: through 2.2.0.
- CVE-2026-38529High 8.8
A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated…
Affected: through 2.2.0.
- CVE-2026-38527High 8.5
A Server-Side Request Forgery (SSRF) in the /settings/webhooks/create component of Webkul Krayin CRM v2.2.x allows attackers to scan…
Affected: through 2.2.0.
- CVE-2026-5370Medium 5.1
krayin laravel-crm Activities Module/Notes inbox.spec.ts composeMail cross site scripting
Affected: through 2.2.0.
- CVE-2024-45932High 7.1
Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting (XSS) via the organization name field in /admin/contacts/organizations/edit/2.
Affected: through 1.3.0.
- CVE-2021-41924Unrated
Webkul krayin crm before 1.2.2 is vulnerable to Cross Site Scripting (XSS).
Affected: fixed in 1.2.2.