PoC-CVE-2026-38526

CVE-2026-38526 - Krayin CRM PHP Upload RCE Exploit automatizado para Krayin CRM ≤ 2.2.x. Este script explota una vulnerabilidad de subida de archivos sin restricciones en el endpoint de TinyMCE /admin/tinymce/upload, evade la validación del tipo MIME falsificando image/jpeg, sube una webshell PHP...

CVE-2026-38526-PoC

CVE-2026-38526 | Krayin CRM v2.2.x 认证后远程代码执行 - 通过 TinyMCE 未限制 PHP 文件上传 描述 CVE-2026-38526 是一个影响 Webkul Krayin CRM v2.2.x 的关键认证后远程代码执行漏洞。该漏洞存在于 TinyMCE 媒体上传端点 /admin/tinymce/upload，该端点未能验证上传的文件类型。经过身份验证的攻击者可以上传恶意 PHP 文件并在服务器上执行任意命令。 CVE： CVE-2026-38526 CVSS 评分： 9.9（严重） CWE： CWE-434 - 未限制危险类型文件上传...

CVE-2026-38526-POC

CVE-2026-38526 - Exploit de RCE en Krayin CRM Krayin CRM ≤ 2.2.x - Carga de archivos sin restricciones que conduce a la ejecución remota de código. Este PoC aprovecha el endpoint vulnerable de carga de TinyMCE /admin/tinymce/upload para subir un webshell PHP y lograr la ejecución de comandos en e...

CVE-2026-82524

UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public stora...

CVE-2026-82524 UnoPim File Upload RCE via TinyMCE Image Upload Endpoint

UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public stora...

CVE-2026-38526

CVE-2026-38526 - Krayin CRM PHP Upload RCE Automatisierter Exploit für Krayin CRM ≤ 2.2.x. Dieses Skript nutzt eine Schwachstelle für uneingeschränkten Dateiupload im TinyMCE-Endpunkt /admin/tinymce/upload aus, umgeht die MIME-Typ-Validierung durch Vortäuschung von image/jpeg, lädt eine...