CVE-2026-36341 is a Cross-Site Scripting (XSS) vulnerability in Webkul Krayin CRM v2.1.5. The issue arises from improper sanitization of user-supplied input in the comment field during the creation of activities at the /admin/activities/create endpoint. This allows an attacker with low privileges and requiring user interaction to inject scripts that can affect confidentiality and integrity with no impact on availability. The vulnerability is classified under CWE-79 and has a CVSS 3.1 score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). There is no known exploit in the wild and no vendor-provided patch or advisory at this time.

Successful exploitation of this vulnerability could allow an attacker with limited privileges to execute arbitrary scripts in the context of other users, potentially leading to partial disclosure and modification of information within the affected application. There is no impact on system availability. The vulnerability requires user interaction and privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected functionality to trusted users only and consider implementing web application firewall (WAF) rules to detect and block malicious input targeting the comment field. Avoid clicking on suspicious links or content related to the affected endpoint.