Advisories · Technology
krayin laravel-crm.
Every CVE that names krayin laravel-crm among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 2.1 Low
Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding
- krayin laravel-crm
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module
- krayin laravel-crm
- Broken access control
- CVSS 7.1 High
Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints
- krayin laravel-crm
- Broken access control
- CVSS 6.9 Medium
Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization
- Krayin laravel-crm
- Broken access control
- CVSS 5.3 Medium
Krayin laravel-crm attachment-download Endpoint acl.php resource injection
- Krayin laravel-crm
- CWE-99
- CVSS 5.3 Medium
Krayin laravel-crm acl.php access control
- Krayin laravel-crm
- Privilege escalation
- Broken access control
- CVSS 4.8 Medium
Krayin laravel-crm Admin Settings Endpoint index.blade.php cross site scripting
- Krayin laravel-crm
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting
- Krayin laravel-crm
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
krayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting
- krayin laravel-crm
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
krayin laravel-crm User Management UserController.php privileges management
- krayin laravel-crm
- Privilege escalation
- CVSS 5.1 Medium
Krayin CRM 2.2.6 Stored Template Injection XSS via Web Form Description
- krayin laravel-crm
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Krayin CRM 2.2.6 Stored Template Injection XSS via Product Name Field
- krayin laravel-crm
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Krayin CRM 2.2.6 Stored Template Injection XSS via Contact Name Field
- krayin laravel-crm
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Krayin CRM 2.2.6 Stored Template Injection XSS via Lead Title
- krayin laravel-crm
- Cross-site scripting (XSS)
- CVSS 8.8 High
Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse
- krayin laravel-crm
- Authentication bypass
- CVSS 8.7 High
Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter
- krayin laravel-crm
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup
- krayin laravel-crm
- Authentication bypass
- CVSS 8.7 High
Krayin CRM Insecure Direct Object Reference via Controllers
- krayin laravel-crm
- Broken access control