PT-2026-29860 · Webkul+1 · Notes Module+2

Dineshrajansv · Published 2026-04-02 · Updated 2026-04-02 · CVE-2026-5370

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions krayin laravel-crm versions up to 2.2

Description A cross-site scripting issue was identified in the composeMail function within the packages/Webkul/Admin/tests/e2e-pw/tests/mail/inbox.spec.ts file of the Activities Module/Notes Module. This manipulation can be exploited remotely, and a public exploit is available.

Recommendations Deploy patch 73ed28d466bf14787fdb86a120c656a4af270153.

Exploit

Fix

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2026-5370

GHSA-9M2V-HC5G-5JPV

Affected Products

Activities Module

Notes Module

Laravel-Crm

References · 10

• 🔥 https://github.com/krayin/laravel-crm/issues/2419 · Exploit
• https://github.com/krayin/laravel-crm/commit/73ed28d466bf14787fdb86a120c656a4af270153 · Patch
• https://github.com/krayin/laravel-crm/pull/2466 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-5370 · Security Note
• https://osv.dev/vulnerability/GHSA-9m2v-hc5g-5jpv · Vendor Advisory
• https://github.com/krayin/laravel-crm · Note
• https://twitter.com/cyberbivash/status/2039782350976844228 · Twitter Post
• https://vuldb.com/vuln/354756 · Note
• https://vuldb.com/submit/781666 · Note
• https://vuldb.com/vuln/354756/cti · Note