CVE-2026-36341

Severity CVSS v4.0:

Pending analysis

Type:

CWE-79 Cross-Site Scripting (XSS)

Publication date:

07/05/2026

Last modified:

07/05/2026

Description

Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5. The application fails to sanitize user-supplied input in the comment field during Activity creation on the /admin/activities/create endpoint

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS v3.1 Severity and Metrics:

Base Score: 5.40 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): Required
Scope (S): Changed
Confidentiality (C): Low
Integrity (I): Low
Availability (A): None

Base Score 3.x

5.40

Severity 3.x

MEDIUM

References to Advisories, Solutions, and Tools

https://cyber.spool.co.jp/vulnerabilities/cve-2026-36341/
https://drive.google.com/file/d/1Y_WjD4Tiq_z7zQUlddFCFMDoyyN300r9/view
https://github.com/cybercrewinc/CVE-2026-36341
https://github.com/krayin/laravel-crm/pull/2401
https://github.com/krayin/laravel-crm/releases/tag/v2.1.6
https://cyber.spool.co.jp/vulnerabilities/cve-2026-36341/