{"action":"Upgrade krayin/laravel-crm to 2.1.6 or later.","affected":[{"fixed":"2.1.6","introduced":"2.1.5"}],"component":"krayin/laravel-crm","cve_ids":["CVE-2026-36341"],"ecosystem":"Packagist","epss":0.0021,"exploited":false,"fixed_versions":["2.1.6"],"ghsa_id":"GHSA-j822-46r5-h4qx","id":"tcs_01M5KF4BYBV3XRQZ4KWK3QVCHT","modified_at":"2026-05-12T17:26:28.751323Z","published_at":"2026-05-07T18:30:40Z","references":["https://osv.dev/vulnerability/GHSA-j822-46r5-h4qx","https://nvd.nist.gov/vuln/detail/CVE-2026-36341","https://github.com/krayin/laravel-crm/pull/2401","https://github.com/krayin/laravel-crm/commit/fc467040de21803cb2b67c2229d2dfcf731d2d3e","https://cyber.spool.co.jp/vulnerabilities/cve-2026-36341","https://drive.google.com/file/d/1Y_WjD4Tiq_z7zQUlddFCFMDoyyN300r9/view","https://github.com/cybercrewinc/CVE-2026-36341","https://github.com/krayin/laravel-crm","https://github.com/krayin/laravel-crm/releases/tag/v2.1.6"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-j822-46r5-h4qx","url":"https://osv.dev/vulnerability/GHSA-j822-46r5-h4qx"}],"summary":"Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint"}