Vulnerability · Published Apr 14, 2025 · Assigned by VulDB

CVE-2025-3568Webkul Krayin CRM SVG File edit cross site scripting

Low 3.5

In plain English

A low-severity cross-site scripting in Krayin CRM from Webkul. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.4%top 62.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

A vulnerability has been found in Webkul Krayin CRM up to 2.1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/settings/users/edit/ of the component SVG File Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor prepares a fix for the next major release and explains that he does not think therefore that this should qualify for a CVE.

Affected products (as reported)

Vendor	Product	Versions
Webkul	Krayin CRM	2.02.1

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

References

VDB-304609 | Webkul Krayin CRM SVG File edit cross site scripting vdb-entry
VDB-304609 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #549591 | Webkul Krayin CRM 2.1.0 Cross Site Scripting third-party-advisory
https://gist.github.com/shellkraft/a8b1f35d5c3ba313605065889563fb00 related
https://drive.google.com/file/d/1LMzZyCgloWquJRWzJAV2bpWMTuiMs6Xa/view?usp=sharing exploit