Webkul Krayin Crm

Krayin CRM 2.2.6 Unauthenticated Email Injection via /admin/mail/inbound-parse
CVE-2026-90944 8.8 - High - September 14, 2026

Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with any subject and body, including replies to existing conversation threads.

Missing Authentication for Critical Function

Krayin CRM before 2.2.4 blind SQLi in LeadDataGrid
CVE-2026-41453 8.7 - High - August 03, 2026

Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rotten_lead[in] query parameter, which is concatenated without parameterized binding directly into a havingRaw() call in LeadDataGrid.php. Attackers can exploit this flaw using time-based and boolean-based blind injection techniques to extract the entire database contents, including user credential hashes, CRM records, and application configuration data.

SQL Injection

Webkul Krayin CRM 2.1.5 XSS in /admin/activities/create Comment Field
CVE-2026-36341 5.4 - Medium - May 07, 2026

Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5. The application fails to sanitize user-supplied input in the comment field during Activity creation on the /admin/activities/create endpoint

XSS

Webkul Krayin CRM 2.2 BOLA: Unauthorized Contact Access
CVE-2026-38532 8.1 - High - April 14, 2026

A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any contact owned by other users via supplying a crafted GET request.

Insecure Direct Object Reference / IDOR

Webkul Krayin CRM v2.2.x BOLA in LeadController.php allows lead data access
CVE-2026-38530 8.1 - High - April 14, 2026

A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any lead owned by other users via supplying a crafted GET request.

Insecure Direct Object Reference / IDOR

Broken OLL in Webkul Krayin CRM v2.2.x /Settings/UserController.php
CVE-2026-38529 8.8 - High - April 14, 2026

A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily reset user passwords and perform a full account takeover via supplying a crafted HTTP request.

Improper Privilege Management

SSRF in Webkul Krayin CRM 2.2.x /settings/webhooks/create internal scan
CVE-2026-38527 8.5 - High - April 14, 2026

A Server-Side Request Forgery (SSRF) in the /settings/webhooks/create component of Webkul Krayin CRM v2.2.x allows attackers to scan internal resources via supplying a crafted POST request.

SSRF

Webkul Krayin CRM 2.2.x - Auth Aut File Upload via /admin/tinymce/upload
CVE-2026-38526 9.9 - Critical - April 14, 2026

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file.

Unrestricted File Upload

CVE-2025-3568 Webkul Krayin CRM <=2.1.0 XSS in SVG Handler
CVE-2025-3568 5.4 - Medium - April 14, 2025

A vulnerability has been found in Webkul Krayin CRM up to 2.1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/settings/users/edit/ of the component SVG File Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor prepares a fix for the next major release and explains that he does not think therefore that this should qualify for a CVE.

XSS

XSS in Krayin CRM v1.3.0 via org name field (/admin/contacts/organizations/edit/2)
CVE-2024-45932 7.1 - High - October 07, 2024

Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting (XSS) via the organization name field in /admin/contacts/organizations/edit/2.

XSS

Stored XSS in Webkul Krayin CRM 1.3.0 via Username Field
CVE-2024-46367 - September 27, 2024

A Stored Cross-Site Scripting (XSS) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to inject arbitrary JavaScript code by submitting a malicious payload within the username field. This can lead to privilege escalation when the payload is executed, granting the attacker elevated permissions within the CRM system.

CSTI in Webkul Krayin CRM 1.3.0 allows remote clientside code execution
CVE-2024-46366 - September 27, 2024

A Client-side Template Injection (CSTI) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to execute arbitrary client-side template code by injecting a malicious payload during the lead creation process. This can lead to privilege escalation when the payload is executed, granting the attacker elevated permissions within the CRM system.

XSS in Webkul krayin CRM 1.2.4 Edit Person Page
CVE-2023-2925 5.4 - Medium - May 27, 2023

A vulnerability, which was classified as problematic, was found in Webkul krayin crm 1.2.4. This affects an unknown part of the file /admin/contacts/organizations/edit/2 of the component Edit Person Page. The manipulation of the argument Organization leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230079. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

XSS