CVE-2026-5370
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A vulnerability in krayin laravel-crm up to version 2.2 in the composeMail function of the inbox.spec.ts file in the Activities and Notes modules allows XSS attacks. The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
An attacker can inject malicious scripts, leading to session theft, defacement, or redirection of users to malicious sites.
Recommendation
Apply the patch with identifier 73ed28d466bf14787fdb86a120c656a4af270153 immediately.
Original NVD description (English source)
A vulnerability was identified in krayin laravel-crm up to 2.2. Impacted is the function composeMail of the file packages/Webkul/Admin/tests/e2e-pw/tests/mail/inbox.spec.ts of the component Activities Module/Notes Module. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is 73ed28d466bf14787fdb86a120c656a4af270153. To fix this issue, it is recommended to deploy a patch.