5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-36341

CVE-2026-36341: Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint

Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5. The application fails to sanitize user-supplied input in the comment field during Activity creation on the /admin/activities/create endpoint

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-36341

CVE-2026-36341:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
krayin/laravel-crm	composer	= 2.1.5	2.1.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Cross-Site Scripting (XSS) issue in the 'comment' field of the activity creation page. The root cause is the application's failure to sanitize user-supplied input before storing and rendering it. The analysis of the provided patch commits reveals that the fix involved a comprehensive security enhancement through the introduction of input sanitization middleware.

The key commit 29df4f6a697af26a32c00dafa31b95e918126d5a, part of the pull request that fixes the vulnerability, introduced two new middleware classes: SanitizeInput and SanitizeFileUploads. The SanitizeInput middleware is particularly relevant as it is designed to automatically sanitize all incoming request data, which would include the vulnerable 'comment' field. The middleware's handle method initiates a recursive sanitization process (sanitizeArray) that cleans each string value (sanitizeString) by removing dangerous content (removeDangerousContent).

Although the final merged commit fc467040de21803cb2b67c2229d2dfcf731d2d3e shows a different strategy of applying strip_tags for output sanitization in various Blade templates, the initial and more robust solution proposed in the pull request was the input sanitization middleware. The functions within this middleware are the precise components that were missing and whose addition rectifies the vulnerability. Therefore, these functions are the most accurate indicators of the vulnerable code paths from a runtime profiling perspective, as they would be directly involved in processing the malicious input when the patch is applied.

Vulnerable functions

Webkul\Core\Http\Middleware\SanitizeInput::handle

packages/Webkul/Core/src/Http/Middleware/SanitizeInput.php

This function intercepts incoming requests and initiates the input sanitization process. It is the primary function that was missing, leading to the XSS vulnerability. Its addition is a direct mitigation of the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.