CVE-2026-97897Low· 3.5▾ TwilightPoC availableA security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The atta…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 19.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
Exploit / PoC code exists
0.2% → 0.3%
A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 is capable of addressing this issue. The patch is identified as 734aa10ae6c2ffa4c96c8869a89aa66940e4d345. You should upgrade the affected component.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-100882Low· 2.4A vulnerability was detected in Krayin laravel-crm up to 2.2.5
CVE-2026-97896Low· 3.5A vulnerability was identified in krayin laravel-crm up to 2.2.5
CVE-2026-100883Medium· 6.3A flaw has been found in Krayin laravel-crm up to 2.2.5
CVE-2026-100884Medium· 4.3A vulnerability has been found in Krayin laravel-crm up to 2.2.5
CVE-2026-97895Medium· 6.3A vulnerability was determined in krayin laravel-crm up to 2.2.5
CVE-2026-100885High· 7.3A vulnerability was found in Krayin laravel-crm up to 2.2.4