| शीर्षक | Krayin Laravel CRM <= 2.1 (before patch in PR #2466) Cross Site Scripting (Stored XSS) – CWE-79 |
|---|
| विवरण | A Stored Cross-Site Scripting (XSS) vulnerability exists in the Activities / Notes module of Krayin Laravel CRM.
The application previously rendered user-supplied activity comments and notes using dynamic HTML rendering (v-html / v-safe-html) in Vue.js components. Because input was not properly escaped, attackers could store malicious JavaScript payloads which would execute whenever the content was viewed.
This allows an authenticated attacker to inject arbitrary JavaScript that executes in the browser of other users accessing the affected record.
The issue was fixed by removing unsafe HTML rendering and switching to escaped Vue interpolation, ensuring user input is rendered as plain text. |
|---|
| स्रोत | ⚠️ https://github.com/krayin/laravel-crm/pull/2466 |
|---|
| उपयोगकर्ता | DineshrajanSv (UID 96525) |
|---|
| सबमिशन | 17/03/2026 08:03 AM (7 महीनों पहले) |
|---|
| संयम | 01/04/2026 08:56 PM (15 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 354756 [krayin laravel-crm तक 2.2 Activities Module/Notes inbox.spec.ts composeMail क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|