PT-2026-99096

CVE-2026-97897

Published

2026-09-25

Updated

2026-09-29

Description by

CVSS 4.0

5.1

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X

Name of the Vulnerable Software and Affected Versions Krayin laravel-crm versions prior to 2.2.6

Description A remote cross-site scripting issue exists due to improper processing within the Sanitizer.php file of the TinyMCE Media Upload component. Cross-site scripting is a technique where malicious scripts are injected into trusted websites.

Recommendations Update to version 2.2.6.

Exploitability

Exploit

Fix

Impacts

Researchers

Bl4Dsc4N

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')