CVE-2026-41453

Name of the Vulnerable Software and Affected Versions Krayin CRM versions prior to 2.2.4

Description Authenticated users with leads access can perform a blind SQL injection in the leads DataGrid. The issue occurs when the rotten lead[in] query parameter is concatenated without parameterized binding directly into a havingRaw() function call within LeadDataGrid.php. This allows attackers to use time-based and boolean-based blind injection techniques to extract sensitive information from the database, such as user credential hashes, CRM records, and application configuration data.

Recommendations Update Krayin CRM to version 2.2.4 or later.