CVE-2026-97896

Received Received - Intake

Stored XSS in Krayin Laravel-CRM

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: VulDB

Description

A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationForm::rules of the file packages/Webkul/Admin/src/Http/Requests/ConfigurationForm.php of the component Upload Functionality. The manipulation leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. Upgrading to version 2.2.6 is able to resolve this issue. The identifier of the patch is b9836530ec9f5ef0f51653bb0cbbc47ef7184f51. It is advisable to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-97896

Affected Vendors & Products

Vendor	Product	Version / Range
krayin	laravel-crm	to 2.2.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability is a cross-site scripting (XSS) issue in krayin laravel-crm versions up to 2.2.5. It exists in the ConfigurationForm::rules function of the Upload Functionality component. An attacker can exploit this remotely to inject malicious scripts into web pages viewed by users.

Detection Guidance

This vulnerability is specific to krayin laravel-crm versions up to 2.2.5 and involves a cross-site scripting issue in the Upload Functionality. Detection involves checking the installed version of krayin laravel-crm. If the version is 2.2.5 or lower, the system is vulnerable.

Impact Analysis

This vulnerability allows attackers to execute malicious scripts in the context of a user's browser session. This could lead to theft of session cookies, account takeover, or defacement of web pages. Users interacting with the affected system may have their data compromised.

Mitigation Strategies

Upgrade krayin laravel-crm to version 2.2.6 or later to resolve the vulnerability. The patch identifier is b9836530ec9f5ef0f51653bb0cbbc47ef7184f51. Ensure no other components or dependencies are using vulnerable versions.

Hi! I’m here to help you understand CVE-2026-97896. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70