krayin/laravel-crm Security Advisories (7)
-
[HIGH] Webkul Krayin CRM has Server-Side Request Forgery (SSRF)
PKSA-gcg3-xvcm-8tz7 CVE-2026-38527 GHSA-fpx9-9hq8-w2xc
Affected version: <=2.2.0
Reported by:
GitHub -
[HIGH] Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php
PKSA-5xsp-55yb-hdyp CVE-2026-38529 GHSA-r8rp-5f55-5j9x
Affected version: <=2.2.0
Reported by:
GitHub -
[HIGH] Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php
PKSA-y1wv-79ht-f4db CVE-2026-38530 GHSA-rm5f-3c25-p4cw
Affected version: <=2.2.0
Reported by:
GitHub -
[HIGH] Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php
PKSA-2w9z-jxqd-y35k CVE-2026-38532 GHSA-2xx8-j85v-j7wh
Affected version: <=2.2.0
Reported by:
GitHub -
[LOW] Krayin CRM is vulnerable to Cross-site Scripting (XSS)
PKSA-9rzv-szxy-ckw5 CVE-2026-5370 GHSA-9m2v-hc5g-5jpv
Affected version: <=2.2.0
Reported by:
GitHub -
[MEDIUM] Krayin CRM vulnerable to Cross Site Scripting (XSS) via the organization name
PKSA-qnd9-s6pr-8wy5 CVE-2024-45932 GHSA-74q2-6jp4-3rqq
Affected version: <=1.3.0
Reported by:
GitHub -
[MEDIUM] Cross-site Scripting in krayin/laravel-crm
PKSA-sggn-xz1p-gyf3 CVE-2021-41924 GHSA-v829-j9rr-85v9
Affected version: <1.2.2
Reported by:
GitHub