SQL Injection

Overview krayin/laravel-crm is a hand tailored CRM framework built on some of the hottest opensource technologies such as Laravel a PHP framework and Vue.js a progressive Javascript framework. Affected versions of this package are vulnerable to SQL Injection via the rottenlead parameter in...

CVE-2026-41453: Improper Neutralization of Special Elements used in an SQL Command

Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rottenleadin query parameter, which is concatenated without parameterized binding directly...

CVE-2026-38528

CVE-2026-38528 affects Krayin CRM v2.2.x and is a SQL injection vulnerability exploitable via the rotten_lead parameter in /Lead/LeadDataGrid.php. The NVD/NVD-derived metrics show CVSS 3.1 base score 7.1 (High), with Network attack vector, Low attack complexity, Privileges Required: Low, User Int...

CVE-2026-38528: Improper Neutralization of Special Elements used in an SQL Command

Krayin CRM v2.2.x was discovered to contain a SQL injection vulnerability via the rottenlead parameter at /Lead/LeadDataGrid.php...

Webkul Krayin CRM 安全漏洞

Webkul Krayin CRM is a free and open-source CRM solution for small and medium-sized businesses from the Indian company Webkul. Version 2.2.x of Webkul Krayin CRM contains a security vulnerability. This vulnerability stems from an SQL injection issue with the rottenlead parameter in the...