CVE-2026-97895Medium· 6.3▾ TwilightPoC availableA vulnerability was determined in krayin laravel-crm up to 2.2.5. This affects an unknown part of the file packages/Webkul/Admin/src/Http/Controllers/Settings/UserController.php of the component User Management. Executing a manipulation …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 34.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
A vulnerability was determined in krayin laravel-crm up to 2.2.5. This affects an unknown part of the file packages/Webkul/Admin/src/Http/Controllers/Settings/UserController.php of the component User Management. Executing a manipulation of the argument role_id can lead to improper privilege management. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.2.6 is able to mitigate this issue. This patch is called 5469d70336fbb25e8e513683e82b32982ce8aa82. Upgrading the affected component is advised.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-100883Medium· 6.3A flaw has been found in Krayin laravel-crm up to 2.2.5
CVE-2026-100884Medium· 4.3A vulnerability has been found in Krayin laravel-crm up to 2.2.5
CVE-2026-100882Low· 2.4A vulnerability was detected in Krayin laravel-crm up to 2.2.5
CVE-2026-97896Low· 3.5A vulnerability was identified in krayin laravel-crm up to 2.2.5
CVE-2026-97897Low· 3.5A security flaw has been discovered in Krayin laravel-crm up to 2.2.5
CVE-2026-100885High· 7.3A vulnerability was found in Krayin laravel-crm up to 2.2.4