CVE-2026-38528 identifies a SQL injection vulnerability in Krayin CRM v2.2.x via the rotten_lead parameter in the /Lead/LeadDataGrid.php endpoint. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity. It requires low attack complexity and low privileges, does not require user interaction, and can be exploited remotely. The impact includes high confidentiality loss and limited integrity compromise. No official remediation or patch information is currently provided, and the vulnerability is not related to a cloud service.

Successful exploitation of this SQL injection vulnerability could allow an attacker to access sensitive database information, leading to a high confidentiality impact. Integrity impact is limited, meaning the attacker may have restricted ability to modify data. The vulnerability can be exploited remotely without user interaction, increasing the risk of unauthorized data disclosure. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply input validation and parameterized queries to mitigate SQL injection risks. Monitor vendor channels for updates regarding patches or official mitigations.