CVE-2026-97897

Received Received - Intake

Stored XSS in Krayin Laravel-CRM via TinyMCE Media Upload

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: VulDB

Description

A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 is capable of addressing this issue. The patch is identified as 734aa10ae6c2ffa4c96c8869a89aa66940e4d345. You should upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-97897

Affected Vendors & Products

Vendor	Product	Version / Range
krayin	laravel-crm	to 2.2.5 (inc)
tinymce	media_upload	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability is a cross-site scripting (XSS) flaw in Krayin laravel-crm versions up to 2.2.5. It exists in the TinyMCE Media Upload component, specifically in the Sanitizer.php file. An attacker can exploit this by uploading malicious content that executes scripts in a user's browser when processed.

Detection Guidance

To detect this vulnerability, check the version of Krayin laravel-crm installed on your system. If it is version 2.2.5 or earlier, the system is vulnerable. Run commands like 'composer show krayin/laravel-crm' or check the version in the application's configuration files.

Impact Analysis

This vulnerability allows remote attackers to inject malicious scripts into web pages viewed by users. This could lead to theft of session cookies, account takeover, or defacement of the CRM interface. Users with access to the CRM could unknowingly execute these scripts.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles. For HIPAA, it may compromise protected health information if exposed. Both standards require protection against such attacks to maintain compliance.

Mitigation Strategies

Upgrade Krayin laravel-crm to version 2.2.6 or later immediately. Apply the patch identified as 734aa10ae6c2ffa4c96c8869a89aa66940e4d345. Remove or restrict access to the TinyMCE Media Upload component if upgrading is not feasible.

Hi! I’m here to help you understand CVE-2026-97897. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70