CVE-2026-36341

MEDIUM

Krayin Laravel CRM 2.1.5 - Stored Cross-Site Scripting in Activity Comment Field

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-36341. PoCs published by cybercrewinc.

AI-analyzed exploit summary The repository provides a detailed technical analysis of an XSS vulnerability in Webkul Krayin CRM, including impact, recommendations, and references to patches. It lacks functional exploit code but includes screenshots and a video PoC demonstrating HTML injection in the admin panel.

Description

Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5. The application fails to sanitize user-supplied input in the comment field during Activity creation on the /admin/activities/create endpoint

Exploits (1)

nomisec WRITEUP

by cybercrewinc · poc

https://github.com/cybercrewinc/CVE-2026-36341

View Code ZIP pw:eip

The repository provides a detailed technical analysis of an XSS vulnerability in Webkul Krayin CRM, including impact, recommendations, and references to patches. It lacks functional exploit code but includes screenshots and a video PoC demonstrating HTML injection in the admin panel.

Classification

Writeup 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: Webkul Krayin CRM (v2.1.6 and prior)

Auth required

Prerequisites: Access to create or edit 'Call' or 'Meeting' logs in the CRM

MITRE ATT&CK