onyx

onyx --cves cve-2026-48540

CVE-2026-48540

MEDPOCVue.js
score
13.5
cvss
5.4
epss
0.2%
published
2026-09-24
kev added
—
first seen

Krayin CRM <= 2.2.6 contains a stored client-side template injection caused by unsanitized Vue.js template expressions in the lead title field, letting authenticated attackers execute arbitrary JavaScript in other users' browsers.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2026-09-24 — PublishedP2026-10-21 (seen by) — Tracked by OnyxT2026-10-21 (seen by) — Public PoC: https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48540Xscore2026-10-21: score 13.513.5epss2026-09-25: epss 0.2%2026-09-26: epss 0.2%2026-09-27: epss 0.2%2026-09-29: epss 0.2%2026-09-30: epss 0.2%2026-10-01: epss 0.2%2026-10-02: epss 0.2%2026-10-03: epss 0.2%2026-10-04: epss 0.2%2026-10-05: epss 0.2%2026-10-06: epss 0.2%2026-10-07: epss 0.2%2026-10-08: epss 0.2%2026-10-09: epss 0.2%2026-10-10: epss 0.2%2026-10-11: epss 0.2%2026-10-12: epss 0.2%2026-10-13: epss 0.2%2026-10-14: epss 0.2%2026-10-15: epss 0.2%2026-10-16: epss 0.2%2026-10-18: epss 0.2%2026-10-19: epss 0.2%2026-10-20: epss 0.2%2026-10-21: epss 0.2%0.2%mentions/day0no mentions in 30 days2026-09-22today
  1. Published
  2. Tracked by Onyx
  3. Public PoC https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48540

Exploit availability

Weaknesses

CWE-79

References 2