CVE-2026-5370

State: PUBLISHED · Published: 2026-04-02 · Updated: 2026-04-03 · Assigner: VulDB

Description

A vulnerability was identified in krayin laravel-crm up to 2.2. Impacted is the function composeMail of the file packages/Webkul/Admin/tests/e2e-pw/tests/mail/inbox.spec.ts of the component Activities Module/Notes Module. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is 73ed28d466bf14787fdb86a120c656a4af270153. To fix this issue, it is recommended to deploy a patch.

CWE

CWE-79 — Cross Site Scripting
CWE-94 — Code Injection

Affected

krayin / laravel-crm — v=2.0 [affected]; v=2.1 [affected]; v=2.2 [affected]

CVSS

4.0 score=5.1 severity=MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
3.1 score=3.5 severity=LOW CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
3.0 score=3.5 severity=LOW CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
2.0 score=4 severity= AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C

References

https://vuldb.com/vuln/354756 vdb-entry, technical-description
https://vuldb.com/vuln/354756/cti signature, permissions-required
https://vuldb.com/submit/781666 third-party-advisory
https://github.com/krayin/laravel-crm/issues/2419 exploit, issue-tracking
https://github.com/krayin/laravel-crm/pull/2466 issue-tracking, patch
https://github.com/krayin/laravel-crm/commit/73ed28d466bf14787fdb86a120c656a4af270153 patch
https://github.com/krayin/laravel-crm/ product

Source

cvelistV5-main/cves/2026/5xxx/CVE-2026-5370.json