| शीर्षक | krayin laravel-crm <=2.2 Stored Cross-Site Scripting (XSS) |
|---|
| विवरण | A Stored Cross-Site Scripting (XSS) vulnerability exists in Krayin Laravel CRM ≤ 2.2 within the Notes field of the Contacts → Persons module.
The application fails to properly sanitize or encode user-supplied input before storing and rendering it. As a result, attackers can inject malicious HTML, CSS, and JavaScript payloads into the Notes field, which are persistently stored in the database.
When the affected record is viewed, the injected payload is executed in the browser of all users accessing the record, including privileged users such as administrators.
This vulnerability enables attackers to perform malicious actions such as:
Session hijacking
Credential theft
Unauthorized actions on behalf of victims
UI manipulation and phishing attacks
Since the payload is stored and executed across multiple users, this issue represents a high-impact stored XSS affecting all users of the system. |
|---|
| स्रोत | ⚠️ https://github.com/krayin/laravel-crm/issues/2419 |
|---|
| उपयोगकर्ता | DineshrajanSv (UID 96525) |
|---|
| सबमिशन | 04/04/2026 09:39 AM (6 महीनों पहले) |
|---|
| संयम | 12/04/2026 09:09 PM (8 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 354756 [krayin laravel-crm तक 2.2 Activities Module/Notes inbox.spec.ts composeMail क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 0 |
|---|