PoC-CVE-2026-38526

CVE-2026-38526 - Krayin CRM PHP 上传 RCE 自动利用 Krayin CRM ≤ 2.2.x 的漏洞。此脚本利用 TinyMCE 端点（/admin/tinymce/upload）中的无限制文件上传漏洞，通过伪造 image/jpeg 绕过 MIME 类型验证，上传 PHP webshell，并以 Web 服务器权限执行任意命令。 漏洞详情 属性| 值 ---|--- CVE ID| CVE-2026-38526 受影响软件| Krayin CRM ≤ 2.2.x 漏洞类型| 无限制文件上传 → 远程代码执行 认证| 必需（任意有效管理员账户） 端点|...

CVE-2026-47761

👋 你好！ 安全研究 🛡️ CVE-2026-47761 – 安全研究员 类型 : Stored Cross-Site Scripting XSS 产品 : TinyMCE 参考 : CVE : https://nvd.nist.gov/vuln/detail/CVE-2026-47761 GHSA : https://github.com/tinymce/tinymce/security/advisories/GHSA-vg35-5wq7-3x7w 名人堂 CVE-2026-47761...

CVE-2026-38526-POC

CVE-2026-38526 - Krayin CRM RCE 漏洞利用 Krayin CRM （≤ 2.2.x）- 不受限制的文件上传，导致远程代码执行。 此 PoC 利用存在漏洞的 TinyMCE 上传端点（/admin/tinymce/upload）上传 PHP WebShell，并在服务器上实现命令执行。 功能 通过 CSRF 令牌处理实现全自动登录 利用双扩展名绕过上传限制 支持反弹 Shell 和单条命令执行 可靠的 Laravel CSRF 令牌刷新 简洁易用 下载 root@kitploit: git clone...

CVE-2019-3396

CVE-2019-3396 Confluence 認証なし RCE CVE-2019-3396 脆弱性 注意点：一部のバージョンではRefererを追加しないと成功しない File Read root@kitploit: POST /rest/tinymce/1/macro/preview HTTP/1.1 Host: 10.10.20.181 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:55.0 Gecko/20100101 Firefox/55.0 Accept: text/plain, /; q=0.01...

Moodle - Cross-Site Scripting/Remote Code Execution

The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system. Moodle versions 4.1.x before 4.1.3 and 4.2.x before...

CVE-2021-37787

CVE-2021-37787: TinyMCEモジュールを介したABOCMSのSQLインジェクション 脆弱性の詳細 CVE ID : CVE-2021-37787 製品 : ABOCMS 影響を受けるバージョン : 5.8.x、≤5.9.3 脆弱性の種類 : SQLインジェクション CVSSスコア : 9.8 説明...

CVE-2026-38526-PoC-htb-nexus

CVE-2026-38526-PoC-htb-nexus CVE-2026-38526のPoCスクリプト。webkul krayin 2.2.xの/admin/tinymce/uploadエンドポイントにおけるファイルアップロード脆弱性を介したRCE（htb-nexus用に作成） 🛠 クイックスタートと使い方 1. リポジトリをクローン: root@kitploit: git clone https://github.com/Resolvdd/CVE-2026-38526-PoC-htb-nexus.git cd CVE-2026-38526-PoC-htb-nexus 2. Pytho...

KrayinCRM-RCE-Exploit-CVE-2026-38526

🔓 Krayin CRM v2.2.x - 認証されたリモートコード実行エクスプロイト ⚠️ 許可されたセキュリティテストのみ - 無許可の使用は違法かつ非倫理的です。 📋 概要 このエクスプロイトツールは、Krayin CRM バージョン 2.2.x で発見された重大な認証済みリモートコード実行 RCE 脆弱性を示しています。この脆弱性は TinyMCE ファイルアップロード機能に存在し、認証済み管理者がサーバー上で任意の PHP コードをアップロードおよび実行することを可能にします。 プロパティ| 値 ---|--- CVE ID| CVE-2026-38526...

CVE-2026-38526-PoC

CVE-2026-38526 | Krayin CRM v2.2.x RCE autenticado - Subida de archivos PHP sin restricciones a través de TinyMCE Descripción CVE-2026-38526 es una vulnerabilidad crítica de ejecución remota de código autenticada que afecta a Webkul Krayin CRM v2.2.x. La vulnerabilidad existe en el endpoint de...

CVE-2026-82524

UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public stora...

CVE-2026-82524

UnoPim before 2.1.5 contains an authenticated file upload vulnerability in its TinyMCE image upload endpoint . Due to missing file extension and MIME type validation, authenticated administrators can upload arbitrary PHP files to the public storage disk, achieving remote code execution by accessi...

EUVD-2026-70265

UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public stora...

CVE-2026-82524 UnoPim File Upload RCE via TinyMCE Image Upload Endpoint

UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public stora...

CVE-2026-82524 UnoPim File Upload RCE via TinyMCE Image Upload Endpoint

UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public stora...

CVE-2026-82524 UnoPim File Upload RCE via TinyMCE Image Upload Endpoint

UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public stora...

PT-2026-84863

Name of the Vulnerable Software and Affected Versions UnoPim versions prior to 2.1.5 Description Authenticated administrators can upload arbitrary PHP files through the TinyMCE image upload endpoint because the system fails to validate file extensions and MIME types. This allows an attacker to...

CVE-2026-38526

CVE-2026-38526 - Krayin CRM PHP Upload RCE Automatisierter Exploit für Krayin CRM ≤ 2.2.x. Dieses Skript nutzt eine Schwachstelle für uneingeschränkten Dateiupload im TinyMCE-Endpunkt /admin/tinymce/upload aus, umgeht die MIME-Typ-Validierung durch Vortäuschung von image/jpeg, lädt eine...

CVE-2026-72743

SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that...

CVE-2026-72743 SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html

SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that...

EUVD-2026-55801

SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that...