CVE-2026-97897

LowCVSS 3.5/10Last modified Sep 29, 2026

Description

A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 is capable of addressing this issue. The patch is identified as 734aa10ae6c2ffa4c96c8869a89aa66940e4d345. You should upgrade the affected component.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Sep 25, 2026
Last modified
Sep 29, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-978988.4Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying CVE-2026-97899In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix memory leak in query_perf_config_list() When krealloc() CVE-2026-97900In the Linux kernel, the following vulnerability has been resolved: drm/drm_exec: fix up contended obj when num_objects is 0 drm_exec_prepCVE-2026-97901In the Linux kernel, the following vulnerability has been resolved: genetlink: pin family module during policy dump The generic netlink coCVE-2026-97902In the Linux kernel, the following vulnerability has been resolved: fs: don't return -EINVAL for successful nested thaw Commit 7366f8b6fc6CVE-2026-979037.8In the Linux kernel, the following vulnerability has been resolved: exit: hold a reference to thread_pid across proc_flush_pid Commit 0a36CVE-2026-97904In the Linux kernel, the following vulnerability has been resolved: cpufreq: initialize policy rwsem before sysfs publication cpufreq_poliCVE-2026-97905In the Linux kernel, the following vulnerability has been resolved: cpufreq: zero-initialize policy cpumask before sysfs publication cpufrCVE-2026-97906In the Linux kernel, the following vulnerability has been resolved: bootconfig: Fix integer overflow in initrd size check Sashiko reportedCVE-2026-97907In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: Don't leak return code when parsing firmware format vCVE-2026-97908In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev TCVE-2026-97909In the Linux kernel, the following vulnerability has been resolved: ASoC: sti: initialize IRQ lock before requesting IRQ uni_reader_init()
CVE-2026-97897: Low severity, CVSS 3.5 | Vulnix