Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-36341 — Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM (HTML Injection) | Kitploit
Tools/GitHubGitHub/cybercrewinc/cve-2026-36341
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityLearning & Education
GitHubcybercrewinc/cve-2026-36341

CVE-2026-36341

Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM (HTML Injection)

View Repository
3 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM (HTML Injection)

CVE:  CVE-2026-36341

Summary

The vulnerability is particularly critical because it affects the Admin Panel. In many CRM workflows, managers or higher-level admins review activities logged by staff. By injecting a payload into a simple "Call" or "Meeting" log, an attacker can target high-privilege accounts without direct interaction with the victim.

PoC

  1. Create a simple description (with html injection)
Pasted image 20260430072720
  1. Final Output Pasted image 20260430072811

References

https://github.com/krayin/laravel-crm/pull/2401
https://github.com/krayin/laravel-crm/releases/tag/v2.1.6  
Video Poc: https://cyber.spool.co.jp/wp-content/uploads/2026/04/krayin-html-injection.mp4

Recommendations

  • Always escape user input before rendering it in HTML.
  • Use auto-escaping templating engines or frameworks.
  • Sanitize input if you allow HTML (e.g., using DOMPurify).
  • Avoid using innerHTML with user data; use textContent instead.
  • Never trust stored data—treat it as unsafe on output.

Impact

  • Attackers can steal user session cookies and hijack accounts.
  • Malicious scripts can run in every user’s browser who views the infected page.
  • Sensitive data (tokens, personal info) can be extracted from the victim.
  • Attackers can perform actions on behalf of users without their consent.
  • Admin accounts can be compromised if they view the malicious content.Pasted image 20260430072720
Download Tool