CVE-2026-48542

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the product name field. Attackers can craft a product name containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected product record.

• https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541
• https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541

• https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541
• https://www.vulncheck.com/advisories/krayin-crm-stored-template-injection-xss-via-product-name-field
• https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541

• MEDIUMCVE-2025-13533PoC
• MEDIUMCVE-2025-14814
• LOWCVE-2025-15677
• MEDIUMCVE-2025-15696
• LOWCVE-2025-15698
• MEDIUMCVE-2025-36147
• HIGHCVE-2025-61682PoC
• MEDIUMCVE-2025-71419PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.