CVE-2026-38526-KrayinCRM-RCE

CVE-2026-38526 - Krayin CRM RCE 제작: infrar3d 이것은 Krayin CRM v2.2.x오픈 소스 고객 관계 관리 시스템를 위해 특별히 설계된 원격 코드 실행RCE 개념 증명입니다. 이 스크립트는 CRM 관리 인터페이스의 파일 업로드 취약점을 자동으로 악용하여 대상 서버에서 원격 명령 실행을 달성합니다. Usage: root@kitploit: python3 CVE-2026-38526.py --help usage: CVE-2026-38526.py -h -rh RHOST -u USERNAME -p...

Hack-The-Box-Nexus-Findings-Report

🛡️ Hack The Box - Отчет о результатах взлома Nexus 📋 Обзор Этот репозиторий содержит комплексный отчет о тестировании на проникновение для машины Hack The Box Nexus. 🔍 Ключевые находки Обнаруженные учетные данные в истории коммитов Gitea - Средняя серьезность Krayin CRM: неограниченная загрузка...

PoC-CVE-2026-38526

CVE-2026-38526 - Krayin CRM PHP Upload RCE Exploit automatizzato per Krayin CRM ≤ 2.2.x. Questo script sfrutta una vulnerabilità di caricamento file senza restrizioni nell'endpoint TinyMCE /admin/tinymce/upload, aggira la validazione del tipo MIME fingendo image/jpeg, carica una webshell PHP ed...

CVE-2026-41452-PoC

CVE-2026-41452 — Bypass dell'autenticazione dell'installer di Krayin CRM → Compromissione dell'admin CVSS 9.8 Critico · CWE-287 / CWE-306 · Report di Jiva · VulnCheck Riepilogo L'installer di Krayin CRM espone POST /install/api/admin-config-setup più run-migration, run-seeder senza protezione CSR...

CVE-2026-38526

CVE-2026-38526 - Krayin CRM PHP Upload RCE Automatisierter Exploit für Krayin CRM ≤ 2.2.x. Dieses Skript nutzt eine Schwachstelle für uneingeschränkten Dateiupload im TinyMCE-Endpunkt /admin/tinymce/upload aus, umgeht die MIME-Typ-Validierung durch Vortäuschung von image/jpeg, lädt eine...

CVE-2026-38526

CVE-2026-38526 - Krayin CRM RCE Descrizione Script PoC per la vulnerabilità critica in Krayin CRM v2.2.x che consente RCE autenticato tramite upload di file senza restrizioni. Utilizzo root@kitploit: Web shell python3 exploit.py -u http://target.com -e [email protected] -p password123 Revers...

CVE-2026-38526-PoC-htb-nexus

CVE-2026-38526-PoC-htb-nexus Uno script PoC per CVE-2026-38526, RCE tramite una vulnerabilità di caricamento file nell'endpoint /admin/tinymce/upload di webkul krayin 2.2.x costruito per htb-nexus 🛠 Avvio rapido e utilizzo 1. Clona il repository: root@kitploit: git clone...

KrayinCRM-RCE-Exploit-CVE-2026-38526

🔓 Krayin CRM v2.2.x - Exploração de Execução Remota de Código Autenticada ⚠️ APENAS PARA TESTES DE SEGURANÇA AUTORIZADOS - O uso não autorizado é ilegal e antiético. 📋 Visão Geral Esta ferramenta de exploração demonstra uma vulnerabilidade crítica de execução remota de código RCE autenticada...

CVE-2026-38526-PoC

CVE-2026-38526 | Krayin CRM v2.2.x Authentifizierte RCE - Uneingeschränkter PHP-Datei-Upload über TinyMCE Beschreibung CVE-2026-38526 ist eine kritische authentifizierte Remote-Codeausführungs-Schwachstelle, die Webkul Krayin CRM v2.2.x betrifft. Die Schwachstelle existiert im...

CVE-2025-3568

CVE-2025-3568 Privilege Escalation via Malicious SVG File Zusammenfassung Eine Sicherheitslücke wurde in Krayin CRM 2.1.0 identifiziert, die es einem Benutzer mit niedrigen Berechtigungen ermöglicht, seine Privilegien zu erweitern, indem er einen Administrator dazu bringt, eine bösartige SVG-Date...

CVE-2026-38526-POC

CVE-2026-38526 - Krayin CRM RCE Exploit Krayin CRM ≤ 2.2.x – Unbeschränkter Datei-Upload, der zu Remote Code Execution führt. Dieser PoC nutzt den verwundbaren TinyMCE-Upload-Endpunkt /admin/tinymce/upload aus, um eine PHP-Webshell hochzuladen und die Befehlsausführung auf dem Server zu erreichen...

CVE-2026-41453

Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rottenleadin query parameter, which is concatenated without parameterized binding directly...

EUVD-2026-52341

Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rottenleadin query parameter, which is concatenated without parameterized binding directly...

CVE-2026-41453 Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter

Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rottenleadin query parameter, which is concatenated without parameterized binding directly...

CVE-2026-41453

Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rottenleadin query parameter, which is concatenated without parameterized binding directly...

CVE-2026-41453 Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter

Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rottenleadin query parameter, which is concatenated without parameterized binding directly...

CVE-2026-41453

Krayin CRM before 2.2.4 is affected by a blind SQL injection in the leads DataGrid. The vulnerability arises from the rotten_lead[in] parameter being concatenated into a HAVING clause inside LeadDataGrid.php without parameterized binding, enabling authenticated users with access to leads to injec...

CVE-2026-41453 Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter

Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rottenleadin query parameter, which is concatenated without parameterized binding directly...

CVE-2026-41452

Krayin CRM 2.2.4 contains a missing authentication flaw in the installer middleware that lets unauthenticated attackers target the admin-config-setup endpoint. By sending a crafted POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall middleware redirect check, an...

CVE-2026-41452

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall...