Vendor
krayin
20 known vulnerabilities.
Products
9 results · Clear filters · Feed
-
Medium 5.3
Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and det…
-
Medium 6.5
Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints
Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search a…
-
Medium 4.3
Krayin laravel-crm attachment-download Endpoint acl.php resource injection
A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download of the file packages/Webkul/Admin/src/Config/acl.php of the component attachment-download Endpoint. The manipulation of the argument ID le…
-
Medium 6.3
Krayin laravel-crm acl.php access control
A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file packages/Webkul/Admin/src/Config/acl.php. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The …
-
Medium 6.3
krayin laravel-crm User Management UserController.php privileges management
A vulnerability was determined in krayin laravel-crm up to 2.2.5. This affects an unknown part of the file packages/Webkul/Admin/src/Http/Controllers/Settings/UserController.php of the component User Management. Executing a manipulation of the argument role_i…
-
Medium 5.4
Krayin CRM 2.2.6 Stored Template Injection XSS via Web Form Description
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. …
-
Medium 5.4
Krayin CRM 2.2.6 Stored Template Injection XSS via Product Name Field
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the product name field. Attacker…
-
Medium 5.4
Krayin CRM 2.2.6 Stored Template Injection XSS via Contact Name Field
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers…
-
Medium 5.4
Krayin CRM 2.2.6 Stored Template Injection XSS via Lead Title
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers …