CVE-2026-38527

A Server-Side Request Forgery (SSRF) in the /settings/webhooks/create component of Webkul Krayin CRM v2.2.x allows attackers to scan internal resources via supplying a crafted POST request.

Affected products

Krayin Crm

CVSS 3.1

8.5 HIGH

EPSS

0.2% (16th percentile)

Weakness

CWE-918

NVD status

Deferred

Published

2026-04-14