CVE-2026-38528

BRIEFING NOTE - CVE-2026-38528 Krayin CRM version 2.2.x contains a SQL injection vulnerability in the LeadDataGrid.php file, specifically within the rotten_lead parameter. This vulnerability allows authenticated users to execute arbitrary SQL queries against the affected system. The flaw represents a significant risk to organizations utilizing this open-source CRM platform. The vulnerability carries a CVSS score of 7.1 (HIGH), indicating considerable severity. It requires network access and low privilege credentials to exploit, with no user interaction needed. The attack has high confidentiality impact through unauthorized data disclosure, low integrity impact through potential data modification, and no availability impact. The straightforward attack complexity and low privilege requirements make this relatively accessible to threat actors with basic system access. There is currently no evidence of active exploitation in the wild, as the vulnerability does not appear on the KEV catalog and is classified as inactive on threat tracking lists. The EPSS score of 0.00029 indicates minimal observed exploitation activity compared to the broader CVE landscape. However, organizations should prioritize patching given the documented SQL injection capability and the moderate FAUCET risk score of 37.0, as functional exploit code could emerge as awareness increases.