CVE-2026-48541 — Krayin CRM 2.2.6 Stored Template Injection XSS via Contact Name Field
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' brows…
Published: 2026-09-24 · CVSS: 5.1 · CVSS 4.0
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected person record.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7