CVE-2026-48542

Krayin CRM versions through 2.2.6 are susceptible to a stored client-side template injection vulnerability. Authenticated attackers can inject Vue.js template expressions into the product name field . By using double-brace template syntax, an attacker can bypass standard filters to reach the Vue ...

EUVD-2026-86446

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the product name field. Attackers can craft a product name containing...

CVE-2026-48541 Krayin CRM 2.2.6 Stored Template Injection XSS via Contact Name Field

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name containing...

CVE-2026-48541 Krayin CRM 2.2.6 Stored Template Injection XSS via Contact Name Field

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name containing...

EUVD-2026-86445

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name containing...

CVE-2026-48541 Krayin CRM 2.2.6 Stored Template Injection XSS via Contact Name Field

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name containing...

CVE-2026-48541

Krayin CRM version 2.2.6 and prior is vulnerable to a stored client-side template injection leading to Cross-Site Scripting (XSS) . The root cause is the application's failure to sanitize the person name field , allowing authenticated attackers to inject Vue.js template expressions using double-b...

EUVD-2026-86383

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing...

CVE-2026-48540 Krayin CRM 2.2.6 Stored Template Injection XSS via Lead Title

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing...

CVE-2026-48540 Krayin CRM 2.2.6 Stored Template Injection XSS via Lead Title

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing...

CVE-2026-48540

Krayin CRM versions through 2.2.6 are vulnerable to a stored client-side template injection vulnerability. An authenticated attacker can inject Vue.js template expressions into the lead title field . By using double-brace template syntax, the attacker can reach the Vue template compiler to perfor...

CVE-2026-48540 Krayin CRM 2.2.6 Stored Template Injection XSS via Lead Title

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing...

CVE-2026-97359

HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template...

EUVD-2026-85879

HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template...

CVE-2026-97359 HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection

HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template...

CVE-2026-97359 HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection

HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template...

CVE-2026-97359

HFS2 version 2.4.0 and earlier are vulnerable to a template injection flaw within the multipart upload handler . Unauthenticated attackers can achieve remote code execution (RCE) on the underlying host system by crafting a filename containing a closing template quoting sequence followed by an exe...

CVE-2026-48540: Improper Neutralization of Input During Web Page Generation

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing...

PT-2026-97805

Name of the Vulnerable Software and Affected Versions HFS2 versions prior to 2.4.1 Description A template injection issue exists in the multipart upload handler. Unauthenticated attackers can achieve remote code execution by embedding malicious template syntax within a filename. By crafting a...

CVE-2026-97359: Improper Neutralization of Special Elements Used in a Template Engine

HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template...