CVE Intelligence

Vulnerabilidades do Webkul Krayin Crm

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Webkul Krayin Crm: 3 registro(s), com versões afetadas e correções.
cpe:2.3:a:webkul:krayin_crm

CVE-2026-38532 Alta · 8.1 CWE-639 14/04/2026
Authorization Bypass Through User-Controlled Key (IDOR) em Webkul Krayin Crm
A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any contact owned by other users via supplying a crafted GET request.
CVE-2026-38530 Alta · 8.1 CWE-639 14/04/2026
Authorization Bypass Through User-Controlled Key (IDOR) em Webkul Krayin Crm
A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any lead owned by other users via supplying a crafted GET request.
CVE-2026-38529 Alta · 8.8 CWE-269 14/04/2026
Improper Privilege Management em Webkul Krayin Crm
A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily reset user passwords and perform a full account takeover via supplying a crafted HTTP request.