PT-2026-36081 · Webkul · Krayin Crm

Published 2026-04-30 · Updated 2026-05-07 · CVE-2026-36341

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Webkul Krayin CRM version 2.1.5

Description A Cross-Site Scripting (XSS) issue occurs due to improper sanitization of user-supplied input in the comment field during activity creation. This allows for HTML injection via the "/admin/activities/create" endpoint using the comment variable.

Recommendations Update Webkul Krayin CRM to a version later than 2.1.5. As a temporary workaround, restrict access to the "/admin/activities/create" endpoint or avoid entering untrusted data into the comment field.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-36341

GHSA-J822-46R5-H4QX

Affected Products

Krayin Crm

References · 10

• 🔥 https://github.com/cybercrewinc/CVE-2026-36341 · Exploit
• 🔥 https://cyber.spool.co.jp/vulnerabilities/cve-2026-36341 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-36341 · Security Note
• https://osv.dev/vulnerability/GHSA-j822-46r5-h4qx · Vendor Advisory
• https://github.com/krayin/laravel-crm/releases/tag/v2.1.6 · Note
• https://github.com/krayin/laravel-crm · Note
• https://github.com/krayin/laravel-crm/commit/fc467040de21803cb2b67c2229d2dfcf731d2d3e · Note
• https://github.com/krayin/laravel-crm/pull/2401 · Note
• https://drive.google.com/file/d/1Y_WjD4Tiq_z7zQUlddFCFMDoyyN300r9/view · Note
• https://twitter.com/VulmonFeeds/status/2049703418726432826 · Twitter Post