Skip to content
Threat Feed
Subscribe

Vendor

Krayin

4 briefs RSS
high advisory

Blind SQL Injection in Krayin CRM leads DataGrid

Krayin CRM versions prior to 2.2.4 contain a blind SQL injection vulnerability in the leads DataGrid, allowing authenticated attackers to exfiltrate database contents via the rotten_lead[in] query parameter.

Krayin CRM sqli vulnerability web-application
1r 1t 1c
critical advisory

Krayin CRM Installer Authentication Bypass Vulnerability

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware, allowing unauthenticated remote attackers to overwrite the administrator account via crafted HTTP POST requests.

Krayin CRM vulnerability crm authentication-bypass
1r 1t 1c
high advisory

Krayin CRM Insecure Direct Object Reference Vulnerability (CVE-2026-61460)

An Insecure Direct Object Reference (IDOR) vulnerability, CVE-2026-61460, in Krayin CRM through version 2.2.3 allows authenticated users to modify, update, or delete records owned by other users by exploiting missing record-level ownership validation in various controllers, leading to unauthorized data manipulation.

Krayin CRM +1 idor crm web-application vulnerability
3t 1c
high advisory

Krayin CRM v2.2.x Authenticated Remote Code Execution Exploit

A public exploit (EDB-52629) has been released for Krayin CRM v2.2.x, demonstrating an authenticated remote code execution vulnerability that allows an authenticated attacker to execute arbitrary code on the underlying system, significantly increasing the risk for unpatched deployments of the web application.

Krayin CRM v2.2.x webapps rce exploit-db krayin-crm crm
1t