GCVE - cpe:2.3:a:webkul:krayin_crm:2.2.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:webkul:krayin_crm:2.2.0:*:*:*:*:*:*:*

part: a version: 2.2.0 update: *

Vendor	Webkul (`08ad6940-8efb-5f93-af42-cb470e3ac46e`)
Product	Krayin Crm (`a27acf1c-cab2-57be-b0be-3bbb8ef20db5`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-38532`	vulnerable	2026-06-08 08:01:16.067310	Details available HIGH (8.1) A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any contact owned by other users via supplying a crafted GET request. Published: 2026-04-14T00:00:00.000Z Updated: 2026-04-14T17:27:56.674Z Open on db.gcve.eu Reference links https://github.com/krayin/laravel-crm https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38532	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-38530`	vulnerable	2026-06-08 08:01:16.067015	Details available HIGH (8.1) A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any lead owned by other users via supplying a crafted GET request. Published: 2026-04-14T00:00:00.000Z Updated: 2026-04-14T17:28:56.838Z Open on db.gcve.eu Reference links https://github.com/krayin/laravel-crm https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38530	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-38529`	vulnerable	2026-06-08 08:01:16.066508	Details available HIGH (8.8) A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily reset user passwords and perform a full account takeover via supplying a crafted HTTP request. Published: 2026-04-14T00:00:00.000Z Updated: 2026-04-14T17:31:13.560Z Open on db.gcve.eu Reference links https://github.com/krayin/laravel-crm https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38529	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.