12 matches found
CVE-2026-41453
Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rottenleadin query parameter, which is concatenated without parameterized binding directly...
CVE-2026-41453 Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter
Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rottenleadin query parameter, which is concatenated without parameterized binding directly...
EUVD-2026-52341
Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rottenleadin query parameter, which is concatenated without parameterized binding directly...
CVE-2026-41453
Krayin CRM before 2.2.4 is affected by a blind SQL injection in the leads DataGrid. The vulnerability arises from the rotten_lead[in] parameter being concatenated into a HAVING clause inside LeadDataGrid.php without parameterized binding, enabling authenticated users with access to leads to injec...
CVE-2026-41453 Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter
Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rottenleadin query parameter, which is concatenated without parameterized binding directly...
CVE-2026-38528
Krayin CRM v2.2.x was discovered to contain a SQL injection vulnerability via the rottenlead parameter at /Lead/LeadDataGrid.php...
EUVD-2026-22299
Krayin CRM v2.2.x was discovered to contain a SQL injection vulnerability via the rottenlead parameter at /Lead/LeadDataGrid.php...
CVE-2026-38528
Krayin CRM v2.2.x was discovered to contain a SQL injection vulnerability via the rottenlead parameter at /Lead/LeadDataGrid.php...
SQL Injection
Overview krayin/laravel-crm is a hand tailored CRM framework built on some of the hottest opensource technologies such as Laravel a PHP framework and Vue.js a progressive Javascript framework. Affected versions of this package are vulnerable to SQL Injection via the rottenlead parameter in the...
CVE-2026-38528
Krayin CRM v2.2.x was discovered to contain a SQL injection vulnerability via the rottenlead parameter at /Lead/LeadDataGrid.php...
PT-2026-32682
Name of the Vulnerable Software and Affected Versions Krayin CRM versions 2.2.x Description SQL injection is possible via the rotten lead parameter at the '/Lead/LeadDataGrid.php' endpoint. SQL injection is a type of flaw that allows an attacker to interfere with the queries that an application...