CVE-2026-36341: Webkul Krayin CRM XSS Vulnerability in Activity Creation Endpoint
Summary
CVE-2026-36341: Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint. Affects krayin/laravel-crm versions >= 2.1.5, < 2.1.6. Fixed in 2.1.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Webkul Krayin CRM is an open-source customer relationship management system built on Laravel. It provides various functionalities for managing customer interactions, activities, and data. However, in version 2.1.5, it has been identified to have a Cross-Site Scripting (XSS) vulnerability that can be exploited through the comment field during activity creation.
Vulnerability Detail
The vulnerability arises from the application's failure to properly sanitize user-supplied input in the comment field on the /admin/activities/create endpoint. This oversight allows attackers to inject malicious scripts, which can execute in the context of the user's browser, potentially leading to data theft, session hijacking, or other malicious actions. The severity of this vulnerability is rated as moderate, with a CVSS score of 5.4.
How To Fix
Minimum fixed version
2.1.6
This is the first release that contains the fix.
composer require krayin/laravel-crm:2.1.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation on the comment field to escape any potentially harmful characters. This can be done by using the
htmlspecialchars() function in PHP, like so: `htmlspecialchars($comment, ENT_QUOTES, 'UTF-8');
` This will help mitigate the risk until the package is updated.
Conclusion
The identified XSS vulnerability in Webkul Krayin CRM poses a moderate risk to applications using version 2.1.5. It is crucial to update to version 2.1.6 or later to ensure the security of your application. Additionally, using Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for krayin/laravel-crm →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
If exploited, this vulnerability could lead to unauthorized access to user data, session hijacking, and other malicious activities.
Yes, a patch is available in version 2.1.6 of the krayin/laravel-crm package. It is recommended to update to this version.
If an immediate update is not possible, implement input validation as a temporary workaround to mitigate the risk of XSS attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for krayin/laravel-crm.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
