CVE-2026-36341: n/a
A Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM version 2. 1. 5. The flaw occurs because the application does not properly sanitize user input in the comment field during Activity creation via the /admin/activities/create endpoint. This vulnerability could allow an attacker with limited privileges to execute malicious scripts in the context of other users. The vulnerability has a CVSS 3. 1 base score of 5. 4, indicating medium severity. No official patch or remediation information is currently available.
AI Analysis
Technical Summary
CVE-2026-36341 is a Cross-Site Scripting (XSS) vulnerability in Webkul Krayin CRM v2.1.5. The issue arises from improper sanitization of user-supplied input in the comment field during the creation of activities at the /admin/activities/create endpoint. This allows an attacker with low privileges and requiring user interaction to inject scripts that can affect confidentiality and integrity with no impact on availability. The vulnerability is classified under CWE-79 and has a CVSS 3.1 score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). There is no known exploit in the wild and no vendor-provided patch or advisory at this time.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker with limited privileges to execute arbitrary scripts in the context of other users, potentially leading to partial disclosure and modification of information within the affected application. There is no impact on system availability. The vulnerability requires user interaction and privileges to exploit.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected functionality to trusted users only and consider implementing web application firewall (WAF) rules to detect and block malicious input targeting the comment field. Avoid clicking on suspicious links or content related to the affected endpoint.
CVE-2026-36341: n/a
Description
A Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM version 2. 1. 5. The flaw occurs because the application does not properly sanitize user input in the comment field during Activity creation via the /admin/activities/create endpoint. This vulnerability could allow an attacker with limited privileges to execute malicious scripts in the context of other users. The vulnerability has a CVSS 3. 1 base score of 5. 4, indicating medium severity. No official patch or remediation information is currently available.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-36341 is a Cross-Site Scripting (XSS) vulnerability in Webkul Krayin CRM v2.1.5. The issue arises from improper sanitization of user-supplied input in the comment field during the creation of activities at the /admin/activities/create endpoint. This allows an attacker with low privileges and requiring user interaction to inject scripts that can affect confidentiality and integrity with no impact on availability. The vulnerability is classified under CWE-79 and has a CVSS 3.1 score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). There is no known exploit in the wild and no vendor-provided patch or advisory at this time.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker with limited privileges to execute arbitrary scripts in the context of other users, potentially leading to partial disclosure and modification of information within the affected application. There is no impact on system availability. The vulnerability requires user interaction and privileges to exploit.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected functionality to trusted users only and consider implementing web application firewall (WAF) rules to detect and block malicious input targeting the comment field. Avoid clicking on suspicious links or content related to the affected endpoint.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-04-06T00:00:00.000Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69fcc30dcbff5d86100edc47
Added to database: 5/7/2026, 4:51:25 PM
Last enriched: 5/7/2026, 5:07:26 PM
Last updated: 5/7/2026, 7:10:09 PM
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.