प्लेटफ़ॉर्म
php
घटक
krayin/laravel-crm
में ठीक किया गया
2.0.1
2.1.1
2.2.1
2.2.1
CVE-2026-5370 describes a Cross-Site Scripting (XSS) vulnerability discovered in the krayin/laravel-crm component, affecting versions up to 2.2.0. This flaw allows attackers to inject malicious scripts into the application, potentially compromising user data and session integrity. A publicly available exploit exists, increasing the risk of exploitation. Applying the provided patch is the recommended solution.
Successful exploitation of CVE-2026-5370 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to various malicious actions, including session hijacking, credential theft, and defacement of the application. The vulnerability resides within the composeMail function of the packages/Webkul/Admin/tests/e2e-pw/tests/mail/inbox.spec.ts file, specifically within the Activities Module/Notes Module. Given the availability of a public exploit, the potential for widespread exploitation is significant, particularly in environments where the component is deployed without proper input sanitization.
CVE-2026-5370 is a publicly disclosed vulnerability with a readily available proof-of-concept. The availability of this exploit significantly increases the likelihood of exploitation, especially given the component's use in various Laravel-based CRM applications. While the CVSS score is LOW, the ease of exploitation and potential impact warrant immediate attention. The vulnerability was published on 2026-04-02.
Organizations using krayin/laravel-crm in their CRM systems, particularly those relying on the Activities Module or Notes Module, are at risk. Shared hosting environments where multiple applications share the same server resources are also at increased risk, as a compromised application could potentially impact other tenants.
• php: Examine application logs for unusual JavaScript execution patterns or error messages related to the Activities Module/Notes Module.
• generic web: Use curl or wget to test the composeMail endpoint with various payloads and observe the response for signs of script execution. curl -X POST -d 'alert("XSS")' <laravel-crm-url>/activities/notes/composeMail
disclosure
एक्सप्लॉइट स्थिति
EPSS
0.03% (10% शतमक)
CISA SSVC
CVSS वेक्टर
The primary mitigation for CVE-2026-5370 is to immediately apply the provided patch (73ed28d466bf14787fdb86a120c656a4af270153). This patch addresses the underlying vulnerability by implementing proper input sanitization to prevent malicious script injection. If applying the patch is not immediately feasible due to compatibility issues or downtime constraints, consider implementing a Web Application Firewall (WAF) rule to filter out potentially malicious requests targeting the composeMail function. Thoroughly test any WAF rules before deploying them to production to avoid disrupting legitimate traffic. After applying the patch, confirm the fix by attempting to inject a simple JavaScript payload through the affected function and verifying that it is properly sanitized.
Krayin laravel-crm के Activities/Notes मॉड्यूल में क्रॉस-साइट स्क्रिप्टिंग (XSS) भेद्यता को ठीक करने के लिए प्रदाता द्वारा प्रदान किए गए पैच (73ed28d466bf14787fdb86a120c656a4af270153) को लागू करने की अनुशंसा की जाती है। वैकल्पिक रूप से, आप उस संस्करण में अपडेट कर सकते हैं जिसमें यह सुधार शामिल है।
भेद्यता विश्लेषण और गंभीर अलर्ट सीधे आपके ईमेल में।
CVE-2026-5370 is an XSS vulnerability in krayin/laravel-crm versions up to 2.2.0, allowing attackers to inject malicious scripts. It impacts the composeMail function and has a LOW severity rating.
You are affected if you are using krayin/laravel-crm version 2.2.0 or earlier. Check your project dependencies to determine if you are using a vulnerable version.
Apply the provided patch (73ed28d466bf14787fdb86a120c656a4af270153) to upgrade your krayin/laravel-crm component to a patched version.
A public proof-of-concept exists, indicating a high likelihood of active exploitation. Prompt mitigation is recommended.
Refer to the krayin/laravel-crm repository or related security advisories for the official announcement and details regarding CVE-2026-5370.
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।