Krayin laravel-crm

• CVE-2026-112288 Low 3.3 Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding 0.2%
• CVE-2026-112287 High 7.1 Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module 0.2%
• CVE-2026-112286 Medium 6.5 Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints 0.2%
• CVE-2026-100885 High 7.3 Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization 1.4%
• CVE-2026-100884 Medium 4.3 Krayin laravel-crm attachment-download Endpoint acl.php resource injection 0.3%
• CVE-2026-100883 Medium 6.3 Krayin laravel-crm acl.php access control 0.3%
• CVE-2026-100882 Low 2.4 Krayin laravel-crm Admin Settings Endpoint index.blade.php cross site scripting 0.3%
• CVE-2026-97897 Low 3.5 Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting 0.3%
• CVE-2026-97896 Low 3.5 krayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting 0.2%
• CVE-2026-97895 Medium 6.3 krayin laravel-crm User Management UserController.php privileges management 0.3%
• CVE-2026-48543 Medium 5.4 Krayin CRM 2.2.6 Stored Template Injection XSS via Web Form Description 0.2%
• CVE-2026-48542 Medium 5.4 Krayin CRM 2.2.6 Stored Template Injection XSS via Product Name Field 0.2%
• CVE-2026-48541 Medium 5.4 Krayin CRM 2.2.6 Stored Template Injection XSS via Contact Name Field 0.1%
• CVE-2026-48540 Medium 5.4 Krayin CRM 2.2.6 Stored Template Injection XSS via Lead Title 0.2%
• CVE-2026-90944 High 8.2 Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse 0.7%
• CVE-2026-41453 High 8.8 Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter 0.5%
• CVE-2026-41452 Critical 9.8 Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup 3.7%
• CVE-2026-61460 High 8.8 Krayin CRM Insecure Direct Object Reference via Controllers 0.5%
• CVE-2026-5370 Low 3.5 krayin laravel-crm Activities Module/Notes inbox.spec.ts composeMail cross site scripting 0.2%