HIGH8.1Packagist
GHSA-2xx8-j85v-j7wh· CVE-2026-38532Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php
Modified: 4/16/2026
package
Packagist/krayin/laravel-crm
pkg:packagist/krayin/laravel-crm
HIGH8.1Packagist
GHSA-32px-ccfx-cxq3· CVE-2026-36340Krayin CRM allows a remote attacker to execute arbitrary code via compose email function
Modified: 5/7/2026
MEDIUM4.8Packagist
GHSA-74q2-6jp4-3rqq· CVE-2024-45932Krayin CRM vulnerable to Cross Site Scripting (XSS) via the organization name
Modified: 10/7/2024
LOW3.5Packagist
GHSA-9m2v-hc5g-5jpv· CVE-2026-5370Krayin CRM is vulnerable to Cross-site Scripting (XSS)
Modified: 4/4/2026
HIGH8.5Packagist
GHSA-fpx9-9hq8-w2xc· CVE-2026-38527Webkul Krayin CRM has Server-Side Request Forgery (SSRF)
Modified: 4/16/2026
MEDIUM5.4Packagist
GHSA-j822-46r5-h4qx· CVE-2026-36341Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint
Modified: 5/12/2026
HIGH8.8Packagist
GHSA-r8rp-5f55-5j9x· CVE-2026-38529Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php
Modified: 4/16/2026
HIGH8.1Packagist
GHSA-rm5f-3c25-p4cw· CVE-2026-38530Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php
Modified: 4/16/2026
MEDIUM6.1Packagist
GHSA-v829-j9rr-85v9· CVE-2021-41924Cross-site Scripting in krayin/laravel-crm
Modified: 11/8/2023