Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: krayin laravel-crm 2.2.7 Clear all filters
TI-2026-76488 CVE-2026-112288 · GHSA-xjh5-97m9-9vqf

SSRF filter bypass via DNS rebinding in Krayin CRM webhooks

Priority LOW 11

Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding.

CVSS 4.0LOW 2.1 Network High privileges No interaction EPSS 0.00218 Published 2026-10-19 Fixed in 2.2.7 CWE-918
TI-2026-76487 CVE-2026-112287 · GHSA-c5rj-qvgf-xg6f

Broken object level authorization in Krayin CRM mail module

Priority LOW 31

Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their nu…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00199 Published 2026-10-19 Fixed in 2.2.7 CWE-639
TI-2026-76486 CVE-2026-112286 · GHSA-fppf-7fvr-hr9c

Insecure direct object reference in Krayin CRM exposes other users' quotes

Priority LOW 31

Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.0025 Published 2026-10-19 Fixed in 2.2.7 CWE-639