onyx

onyx --cves cve-2026-48542

CVE-2026-48542

MEDPOCVue.js
score
13.5
cvss
5.4
epss
0.1%
published
2026-09-24
kev added
—
first seen

Krayin CRM <= 2.2.6 contains a stored XSS caused by injection of Vue.js template expressions in the product name field, letting authenticated attackers execute arbitrary JavaScript in other users' browsers.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2026-09-24 — PublishedP2026-10-21 (seen by) — Tracked by OnyxT2026-10-21 (seen by) — Public PoC: https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541Xscore2026-10-21: score 13.513.5epss2026-09-25: epss 0.1%2026-09-26: epss 0.1%2026-09-27: epss 0.1%2026-09-29: epss 0.1%2026-09-30: epss 0.1%2026-10-01: epss 0.1%2026-10-02: epss 0.1%2026-10-03: epss 0.1%2026-10-04: epss 0.1%2026-10-05: epss 0.1%2026-10-06: epss 0.1%2026-10-07: epss 0.1%2026-10-08: epss 0.1%2026-10-09: epss 0.1%2026-10-10: epss 0.1%2026-10-11: epss 0.1%2026-10-12: epss 0.1%2026-10-13: epss 0.1%2026-10-14: epss 0.1%2026-10-15: epss 0.1%2026-10-16: epss 0.1%2026-10-18: epss 0.1%2026-10-19: epss 0.1%2026-10-20: epss 0.1%2026-10-21: epss 0.1%0.1%mentions/day0no mentions in 30 days2026-09-22today
  1. Published
  2. Tracked by Onyx
  3. Public PoC https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541

Exploit availability

Weaknesses

CWE-79

References 2