CVE-2026-36340

Description

An issue in Krayin CRM v.2.1.5, which was fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function.

Affected packages (1)

• Packagist/krayin/laravel-crm>= 2.1.5, < 2.1.6

CVSS scores

References (5)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-36340
• PATCHhttps://github.com/krayin/laravel-crm
• WEBhttps://drive.google.com/file/d/1yBdvbrXGf9fsFckmK9zTe2v8_vDtdicH/view
• WEBhttps://github.com/cybercrewinc/CVE-2026-36340
• WEBhttps://github.com/krayin/laravel-crm/releases/tag/v2.1.6