CVE-2026-36341: Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint
Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5. The application fails to sanitize user-supplied input in the comment field during Activity creation on the /admin/activities/create endpoint
Other sources
Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/krayin/laravel-crmto a version that resolves this vulnerability.Fixed in 2.1.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-36341?
CVE-2026-36341 is classified as a high severity Cross-Site Scripting (XSS) vulnerability.
How do I fix CVE-2026-36341?
To fix CVE-2026-36341, upgrade Webkul Krayin CRM to version 2.1.6 or later.
What are the potential impacts of CVE-2026-36341?
CVE-2026-36341 could allow attackers to execute arbitrary JavaScript in users' browsers, compromising their sessions or data.
Which software is affected by CVE-2026-36341?
CVE-2026-36341 specifically affects Webkul Krayin CRM version 2.1.5.
Where does the vulnerability occur in CVE-2026-36341?
The vulnerability occurs in the comment field during Activity creation at the /admin/activities/create endpoint.