Low severity3.5NVD Advisory· Published Apr 2, 2026· Updated Apr 29, 2026
CVE-2026-5370
CVE-2026-5370
Description
A vulnerability was identified in krayin laravel-crm up to 2.2. Impacted is the function composeMail of the file packages/Webkul/Admin/tests/e2e-pw/tests/mail/inbox.spec.ts of the component Activities Module/Notes Module. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is 73ed28d466bf14787fdb86a120c656a4af270153. To fix this issue, it is recommended to deploy a patch.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
krayin/laravel-crmPackagist | <= 2.2.0 | — |
Affected products
2Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-9m2v-hc5g-5jpvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-5370ghsaADVISORY
- github.com/krayin/laravel-crm/commit/73ed28d466bf14787fdb86a120c656a4af270153nvdWEB
- github.com/krayin/laravel-crm/issues/2419nvdWEB
- github.com/krayin/laravel-crm/pull/2466nvdWEB
- vuldb.com/submit/781666nvdWEB
- vuldb.com/vuln/354756nvdWEB
- vuldb.com/vuln/354756/ctinvdWEB
News mentions
0No linked articles in our index yet.