Riskcovery

CVE-2026-5370

krayin laravel-crm Activities Module/Notes inbox.spec.ts composeMail cross site scripting

State
Published
Severity
5.1 Medium
Published
Apr 2, 2026
Updated
Apr 3, 2026
Reserved
Apr 1, 2026

Read the record on cve.org

Description

A vulnerability was identified in krayin laravel-crm up to 2.2. Impacted is the function composeMail of the file packages/Webkul/Admin/tests/e2e-pw/tests/mail/inbox.spec.ts of the component Activities Module/Notes Module. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is 73ed28d466bf14787fdb86a120c656a4af270153. To fix this issue, it is recommended to deploy a patch.

Scores

CVSSScoreVectorSource
4.05.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:PVulDB
3.13.5 LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:CVulDB
3.03.5 LowCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:CVulDB
2.04.0 MediumAV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:CVulDB

Weaknesses

Affected Products

ProductVersions
laravel-crmkrayin
  • 2.0Affected
  • 2.1Affected
  • 2.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.