CVE-2026-38526-PoC-htb-nexus

CVE-2026-38526-PoC-htb-nexus CVE-2026-38526에 대한 PoC 스크립트입니다. webkul krayin 2.2.x의 /admin/tinymce/upload 엔드포인트에 있는 파일 업로드 취약점을 통한 RCE입니다 htb-nexus용으로 제작됨 🛠 빠른 시작 및 사용법 1. 저장소 클론: git clone https://github.com/Resolvdd/CVE-2026-38526-PoC-htb-nexus.git cd CVE-2026-38526-PoC-htb-nexus 2. Python 가상 환경...

CVE-2026-38526-KrayinCRM

CVE-2026-38526 KrayinCRM Authenticated Arbitrary File Upload leading to Remote Code Execution Technical analysis and controlled reproduction of CVE-2026-38526 in Webkul Krayin CRM 2.2.x. Overview CVE-2026-38526 is an authenticated arbitrary file upload vulnerability affecting Webkul Krayin CRM...

CVE-2026-38526

CVE-2026-38526 — Krayin CRM ≤ 2.2.x 認証済みRCE ⚠️ 法的警告 ：このコードは教育目的および 許可されたテスト（CTF、バグバウンティ、プライベートラボ）専用として提供されています。 作者は不正使用に対して一切の責任を負いません。 説明 Krayin CRM（Webkul）≤ 2.2.x はエンドポイント /admin/tinymce/upload を公開しており、 これにより認証済みユーザー（低権限であっても）が拡張子の検証なしに ファイルをアップロードできます。その後ファイルは storage/ フォルダから...

CVE-2026-38526

CVE-2026-38526 — Krayin CRM ≤ 2.2.x 认证后 RCE ⚠️ 法律声明 ：此代码仅供教育目的 和授权测试使用（CTF、漏洞赏金、私人实验室）。 作者不对非法使用承担责任。 描述 Krayin CRM Webkul ≤ 2.2.x 暴露了 /admin/tinymce/upload 端点，允许已认证用户（即使是低权限用户） 上传文件而不验证扩展名。该文件随后 从 storage/ 目录提供服务，从而允许 任意执行 PHP 代码。 类型 ：任意文件上传 → RCE CVSS ：9.9（严重） 需要认证 ：是（任何有效账户） 安装 git clone...

Exploit for CVE-2026-38526

CVE-2026-38526 — Krayin CRM ≤ 2.2.x Authenticated RCE ⚠️...

Exploit for CVE-2026-38526

CVE-2026-38526 — Krayin CRM ≤ 2.2.x Authenticated RCE ⚠️...

PT-2026-84863

Name of the Vulnerable Software and Affected Versions UnoPim versions prior to 2.1.5 Description Authenticated administrators can upload arbitrary PHP files through the TinyMCE image upload endpoint because the system fails to validate file extensions and MIME types. This allows an attacker to...

Exploit for CVE-2026-38526

CVE-2026-38526-PoC-htb-nexus-...

Exploit for CVE-2026-38526

CVE-2026-38526-PoC-htb-nexus-...

Exploit for CVE-2026-38526

CVE-2026-38526 - Krayin CRM PHP Upload RCE Automated exploit...

CVE-2026-38526

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file...

Exploit for CVE-2026-38526

CVE-2026-38526 | Krayin CRM v2.2.x Authenticated RCE - Unrestr...

EUVD-2026-22296

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file...

CVE-2026-38526

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file...

Arbitrary Code Injection

Overview krayin/laravel-crm is a hand tailored CRM framework built on some of the hottest opensource technologies such as Laravel a PHP framework and Vue.js a progressive Javascript framework. Affected versions of this package are vulnerable to Arbitrary Code Injection via the /admin/tinymce/uplo...

PT-2026-32680

Name of the Vulnerable Software and Affected Versions Krayin CRM versions 2.2.x and earlier Description An authenticated arbitrary file upload flaw exists in the /admin/tinymce/upload endpoint. This issue allows an authenticated attacker to upload a crafted PHP file, leading to remote code...

Webkul Krayin CRM 安全漏洞

Webkul Krayin CRM is a free and open-source CRM solution for small and medium-sized businesses from the Indian company Webkul. Version 2.2.x of Webkul Krayin CRM contains a security vulnerability. This vulnerability stems from the admin/tinymce/upload endpoint, where an authenticated arbitrary fi...

CVE-2026-38526

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file...

CVE-2026-38526: Unrestricted Upload of File with Dangerous Type

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file...

CVE-2026-38526

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file...