Is CVE-2026-36341 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-36341 being exploited in the wild.

How severe is CVE-2026-36341?

Medium severity, with a CVSS score of 5.4, published 7 May 2026.

Which products and versions are affected?

krayin/laravel-crm (Packagist) = 2.1.5, ECOSYSTEM:introduced=2.1.5,fixed=2.1.6; Webkul Krayin CRM 2.1.5.

Is there a fix for CVE-2026-36341?

Yes. krayin/laravel-crm (Packagist): upgrade to 2.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-36341 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-36341?

Check whether you run krayin/laravel-crm (Packagist) or Webkul Krayin CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-36341: Webkul Krayin CRM stored XSS in activity creation

CVE-2026-36341 · Severity: medium · CVSS 5.4 · Published 2026-05-07

Webkul Krayin CRM, a customer relationship management platform, is vulnerable to a security flaw where malicious code can be embedded in activity logs. An attacker with basic user access can create a 'Call' or 'Meeting' entry containing malicious scripts that execute when a manager or administrator views the activity. This could allow an attacker to hijack administrative sessions, steal sensitive customer data, or perform unauthorized actions on behalf of high-privileged users.

Technologies: krayin/laravel-crm (Packagist), Webkul Krayin CRM. Vendors: Packagist, Webkul.

Quick answers

Is CVE-2026-36341 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-36341 being exploited in the wild.
How severe is CVE-2026-36341?: Medium severity, with a CVSS score of 5.4, published 7 May 2026.
Which products and versions are affected?: krayin/laravel-crm (Packagist) = 2.1.5, ECOSYSTEM:introduced=2.1.5,fixed=2.1.6; Webkul Krayin CRM 2.1.5.
Is there a fix for CVE-2026-36341?: Yes. krayin/laravel-crm (Packagist): upgrade to 2.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-36341 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-36341?: Check whether you run krayin/laravel-crm (Packagist) or Webkul Krayin CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

krayin/laravel-crm (Packagist): upgrade to 2.1.6 or later
```
composer require krayin/laravel-crm:^2.1.6
```

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5 due to improper neutralization of user-supplied input in the 'comment' or 'description' fields during activity creation. Specifically, the '/admin/activities/create' endpoint fails to sanitize or escape HTML and JavaScript before rendering it in the administrative dashboard. An attacker with low-level privileges can inject malicious payloads into activity logs (such as 'Call' or 'Meeting' records). When a high-privileged user, such as a manager or administrator, views these activities as part of their normal workflow, the payload executes in their browser. This can lead to session hijacking via cookie theft, unauthorized data exfiltration, or account takeover. The issue is addressed in version 2.1.6 by implementing proper output encoding and input sanitization.

Affected products

Webkul Krayin CRM 2.1.5

Identifiers

CVE-2026-36341
GHSA-j822-46r5-h4qx

Timeline

2025-12-12: other: Initial fix pull request submitted
2025-12-29: patched: Version 2.1.6 released
2026-05-07: disclosed: CVE-2026-36341 published
2026-05-07: advisory: GitHub Advisory GHSA-j822-46r5-h4qx published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.