CVE-2024-46366

Published: Sep 27, 2024Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A Client-side Template Injection (CSTI) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to execute arbitrary client-side template code by injecting a malicious payload during the lead creation process. This can lead to privilege escalation when the payload is executed, granting the attacker elevated permissions within the CRM system.

Affected (1)

Products: Webkul: Krayin Crm

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Webkul Krayin Crm	Version 1.3.0

Related CWEs

Improper Neutralization of Special Elements Used in a Template Engine

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

References (1)

https://gist.github.com/Tommywarren/89cef7f876ee897a4ff40a8b71b6208e

Source: cve@mitre.org

Third Party Advisory

Timeline

No history available yet.