CVE-2024-45932 identifies a Cross Site Scripting (XSS) vulnerability in Krayin CRM version 1.3.0. The issue arises from insufficient input sanitization or output encoding of the organization name field within the administrative interface at /admin/contacts/organizations/edit/2. This vulnerability can lead to the execution of arbitrary scripts in the context of authenticated users, potentially resulting in data theft, session hijacking, or other client-side impacts. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at low to low levels. No patch or official remediation has been documented as of the publication date.

Successful exploitation of this XSS vulnerability could allow an attacker to execute arbitrary JavaScript in the browser of an authenticated user interacting with the vulnerable page. This may lead to theft of sensitive information, session hijacking, or manipulation of the user interface. The vulnerability affects confidentiality, integrity, and availability at low levels but can still pose significant risk in environments where administrative access is sensitive.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the affected administrative interface to trusted users only and apply web application firewall (WAF) rules to detect and block malicious input targeting the organization name field. Input validation and output encoding should be implemented as a long-term fix once a patch is released.