CVE-2026-5370

LOW

krayin laravel-crm Activities Module/Notes inbox.spec.ts composeMail cross site scripting

Title source: cna
STIX 2.1

Description

A vulnerability was identified in krayin laravel-crm up to 2.2. Impacted is the function composeMail of the file packages/Webkul/Admin/tests/e2e-pw/tests/mail/inbox.spec.ts of the component Activities Module/Notes Module. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is 73ed28d466bf14787fdb86a120c656a4af270153. To fix this issue, it is recommended to deploy a patch.

References (7)

Core 7
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-354756 | krayin laravel-crm Activities Module/Notes inbox.spec.ts composeMail cross site scripting
https://vuldb.com/vuln/354756
Signature, Permissions Required signature permissions-required
VDB-354756 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/354756/cti
Third Party Advisory third-party-advisory
Submit #781666 | Krayin Laravel CRM <= 2.1 (before patch in PR #2466) Cross Site Scripting (Stored XSS) – CWE-79
https://vuldb.com/submit/781666
Exploit exploit issue-tracking
https://github.com/krayin/laravel-crm/issues/2419

Scores

CVSS v3 3.5
EPSS 0.0020
EPSS Percentile 10.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79 CWE-94
Status published
Products (4)
krayin/laravel-crm 0Packagist
krayin/laravel-crm 2.0
krayin/laravel-crm 2.1
krayin/laravel-crm 2.2
Published Apr 02, 2026
Tracked Since Apr 02, 2026