CVE-2024-45932

MediumCVSS 4.8

Published: 07/10/2024(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

31th percentile - higher than 31% of all known CVEs

Summary

Krayin CRM version 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the organization name field in /admin/contacts/organizations/edit/2. An attacker can inject malicious JavaScript code that will execute in the administrator's browser.

Risk Assessment

The risk includes potential theft of administrator sessions, account takeover, or unauthorized actions within the CRM system, leading to customer data leakage and confidentiality breaches.

Recommendation

Immediately update Krayin CRM to the latest patched version and implement input validation and sanitization for the organization name field.

Original NVD description (English source)

Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting (XSS) via the organization name field in /admin/contacts/organizations/edit/2.