Arbitrary Code Injection

Overview krayin/laravel-crm is a hand tailored CRM framework built on some of the hottest opensource technologies such as Laravel a PHP framework and Vue.js a progressive Javascript framework. Affected versions of this package are vulnerable to Arbitrary Code Injection via the compose email...

CVE-2026-36340

Krayin CRM v.2.1.5 is vulnerable to Remote Code Execution (RCE) via the Email $\rightarrow$ Compose feature. The application fails to perform sufficient validation—such as extension checks, MIME type verification, or executable file restrictions—when processing attachments for the POST /admin/mai...