Description
A vulnerability was detected in Krayin laravel-crm up to 2.2.5. Impacted is an unknown function of the file packages/Webkul/Admin/src/Resources/views/components/layouts/index.blade.php of the component Admin Settings Endpoint. Performing a manipulation of the argument general.settings.footer.label results in cross site scripting. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 2.2.6 is recommended to address this issue. The patch is named 6dbcf75b30dbd169ee81b7e9e00368099124efeb. You should upgrade the affected component.
Published: 2026-09-27
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross Site Scripting
Action: Apply Patch
AI Analysis

Impact

A stored cross‑site scripting flaw exists in the Admin Settings Endpoint of Krayin laravel‑crm in the file packages/Webkul/Admin/src/Resources/views/components/layouts/index.blade.php. Manipulating the argument general.settings.footer.label allows an attacker to inject arbitrary JavaScript that is rendered in the context of an authenticated administrator’s browser session. The attack can be initiated remotely, and the exploit is now public.

Affected Systems

The vulnerability affects all installations of Krayin laravel‑crm up to version 2.2.5. The fix is available in version 2.2.6 and newer, with the relevant patch identified by commit 6dbcf75b30dbd169ee81b7e9e00368099124efeb.

Risk and Exploitability

The CVSS score of 4.8 indicates a low‑to‑moderate severity, but the flaw can be triggered remotely and is publicly documented, making exploitation straightforward for attackers with access to the Admin Settings interface. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog.

Generated by OpenCVE AI on September 27, 2026 at 23:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official update to Krayin laravel‑crm version 2.2.6 or later.
  • Sanitize or escape any user‑supplied content rendered in the footer label to prevent script injection.
  • Implement a Web Application Firewall rule to detect and block attempts to modify the footer.label parameter with malicious payloads.

Generated by OpenCVE AI on September 27, 2026 at 23:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 27 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in Krayin laravel-crm up to 2.2.5. Impacted is an unknown function of the file packages/Webkul/Admin/src/Resources/views/components/layouts/index.blade.php of the component Admin Settings Endpoint. Performing a manipulation of the argument general.settings.footer.label results in cross site scripting. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 2.2.6 is recommended to address this issue. The patch is named 6dbcf75b30dbd169ee81b7e9e00368099124efeb. You should upgrade the affected component.
Title Krayin laravel-crm Admin Settings Endpoint index.blade.php cross site scripting
First Time appeared Krayin
Krayin laravel-crm
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:krayin:laravel-crm:*:*:*:*:*:*:*:*
Vendors & Products Krayin
Krayin laravel-crm
References
Metrics cvssV2_0

{'score': 3.3, 'vector': 'AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 2.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 2.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Krayin Laravel-crm
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-30T22:14:49.571Z

Reserved: 2026-09-27T03:43:54.754Z

Link: CVE-2026-100882

cve-icon Vulnrichment

Updated: 2026-09-30T22:14:45.795Z

cve-icon NVD

Status : Deferred

Published: 2026-09-27T22:17:06.123

Modified: 2026-09-30T23:16:56.663

Link: CVE-2026-100882

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-28T00:00:11Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')