{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-27T08:42:42.813","vulnerabilities":[{"cve":{"id":"CVE-2024-46366","sourceIdentifier":"cve@mitre.org","published":"2024-09-27T17:15:13.400","lastModified":"2026-06-17T07:55:18.877","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A Client-side Template Injection (CSTI) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to execute arbitrary client-side template code by injecting a malicious payload during the lead creation process. This can lead to privilege escalation when the payload is executed, granting the attacker elevated permissions within the CRM system."},{"lang":"es","value":"Una vulnerabilidad de inyección de plantilla del lado del cliente (CSTI) en Webkul Krayin CRM 1.3.0 permite a atacantes remotos ejecutar código de plantilla arbitrario del lado del cliente mediante la inyección de un payload malicioso durante el proceso de creación de clientes potenciales. Esto puede provocar una escalada de privilegios cuando se ejecuta payload, lo que otorga al atacante permisos elevados dentro del sistema CRM."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"webkul","product":"krayin_crm","defaultStatus":"unknown","cpes":["cpe:2.3:a:webkul:krayin_crm:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-09-27T19:14:24.236829Z","id":"CVE-2024-46366","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-1336"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:webkul:krayin_crm:1.3.0:*:*:*:*:*:*:*","matchCriteriaId":"5BB7498D-D884-4F48-A7A8-947DE1942722"}]}]}],"references":[{"url":"https://gist.github.com/Tommywarren/89cef7f876ee897a4ff40a8b71b6208e","source":"cve@mitre.org","tags":["Third Party Advisory"]}]}}]}