An attacker could inject malicious scripts into the comment field when creating an activity on the /admin/activities/create endpoint. The application does not properly sanitize user-supplied input, allowing injected script code to execute in the browser context of any user viewing the activity. This reflected XSS flaw permits execution of arbitrary client-side code, which could be used to steal session cookies, hijack user sessions, deface the interface, or load additional malicious payloads. The weakness is a classic Cross‑Site Scripting attack (CWE‑79).

The vulnerability is present in Webkul Krayin CRM version 2.1.5. No other affected versions are listed, and the issue is limited to this product and release.

No EPSS score is available, and the vulnerability is not in the CISA KEV catalog, so exploitation probability is currently unknown. The flaw resides in an administrative endpoint, implying that an attacker needs access to the admin interface or a way to submit data to that endpoint. Without a public exploit, the risk depends on the organization’s exposure of the admin interface. The impact level of reflected XSS can range from moderate to high depending on whether the victim is an administrator or a regular user, as it can lead to credential theft and session hijacking. The CVSS score is not provided, but such vulnerabilities are typically considered high severity.