Krayin vulnerabilities
We track 6 vulnerabilities in Krayin products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 19, 2026.
Latest Krayin vulnerabilities
- 7.1 High severity
laravel-crm: Authorization Bypass Through User-Controlled Key
Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, de
- 7.3 High severity
laravel-crm: Improper Authorization
A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization b
- 8.2 High severity
laravel-crm: Missing Authentication for Critical Functionality
Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information
- 8.8 High severity
laravel-crm: Improper Neutralization of Special Elements used in an SQL Command
Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rotten_lead[in] query parameter, which is concatenated
- 9.8 Critical severity
laravel-crm: Missing Authentication for Critical Functionality
Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRe
- 8.8 High severity
laravel-crm: Authorization Bypass Through User-Controlled Key
Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController that allows authenticated users to edit, update, or delete records owned by