CVE-2024-46366
HIGHWebkul Krayin CRM 1.3.0 - Client-side Template Injection via Lead Creation
Title source: llmDescription
A Client-side Template Injection (CSTI) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to execute arbitrary client-side template code by injecting a malicious payload during the lead creation process. This can lead to privilege escalation when the payload is executed, granting the attacker elevated permissions within the CRM system.
References (1)
Core 1
Core References
Third Party Advisory
https://gist.github.com/Tommywarren/89cef7f876ee897a4ff40a8b71b6208e
Scores
CVSS v3
8.8
EPSS
0.0049
EPSS Percentile
37.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-1336
Status
published
Products (1)
webkul/krayin_crm
1.3.0
Published
Sep 27, 2024
Tracked Since
Feb 18, 2026