CVE-2026-36340

An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function...

CVE-2026-38528

Krayin CRM v2.2.x was discovered to contain a SQL injection vulnerability via the rottenlead parameter at /Lead/LeadDataGrid.php...

CVE-2026-36340

Krayin CRM v.2.1.5 is vulnerable to Remote Code Execution (RCE) via the Email $\rightarrow$ Compose feature. The application fails to perform sufficient validation—such as extension checks, MIME type verification, or executable file restrictions—when processing attachments for the POST /admin/mai...

PT-2026-36116

An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function...