CVE-2021-37787

CVE-2021-37787: SQL-инъекция в ABOCMS через модуль TinyMCE Детали уязвимости ID CVE : CVE-2021-37787 Продукт : ABOCMS Затронутые версии : 5.8.x, ≤5.9.3 Тип уязвимости : SQL-инъекция Оценка CVSS : 9.8 Описание Критическая уязвимость SQL-инъекции существует в ABOCMS в модуле TinyMCE. Уязвимость...

Moodle - Cross-Site Scripting/Remote Code Execution

The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system. Moodle versions 4.1.x before 4.1.3 and 4.2.x before...

EUVD-2026-91855

Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when frontend TinyMCE is enabled. Attackers can submit malicious JavaScript, which ItemActions.php saves without tag stripping,...

CVE-2026-104479

Versions of Shopclass prior to 6.2.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. When the frontend TinyMCE is enabled, self-registered non-admin users can inject malicious JavaScript into item listing descriptions. The root cause is that the ItemActions.php component save...

CVE-2019-3396

CVE-2019-3396 Vulnérabilité RCE non authentifiée dans Confluence CVE-2019-3396 Piège : certaines versions nécessitent d'ajouter un en-tête Referer pour réussir Lecture de fichier POST /rest/tinymce/1/macro/preview HTTP/1.1 Host: 10.10.20.181 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64;...

CVE-2026-38526-PoC-htb-nexus

CVE-2026-38526-PoC-htb-nexus Un script PoC pour CVE-2026-38526, RCE via une vulnérabilité de téléchargement de fichier dans le point de terminaison /admin/tinymce/upload de webkul krayin 2.2.x conçu pour htb-nexus 🛠 Démarrage rapide et utilisation 1. Clonez le dépôt : git clone...

CVE-2026-38526-KrayinCRM

CVE-2026-38526 KrayinCRM Authenticated Arbitrary File Upload leading to Remote Code Execution Technical analysis and controlled reproduction of CVE-2026-38526 in Webkul Krayin CRM 2.2.x. Overview CVE-2026-38526 is an authenticated arbitrary file upload vulnerability affecting Webkul Krayin CRM...

CVE-2026-38526

CVE-2026-38526 — Krayin CRM ≤ 2.2.x Authenticated RCE ⚠️ Предупреждение о правовых последствиях : этот код предоставлен исключительно в образовательных целях и для авторизованного тестирования CTF, bug bounty, частная лаборатория. Автор не несёт ответственности за незаконное использование. Описани...

CVE-2026-38526

CVE-2026-38526 — Krayin CRM ≤ 2.2.x Authenticated RCE ⚠️ Правовая оговорка : этот код предоставлен исключительно в образовательных целях и для авторизованного тестирования CTF, bug bounty, частная лаборатория. Автор не несёт ответственности за незаконное использование. Описание Krayin CRM Webkul ≤...

KrayinCRM-RCE-Exploit-CVE-2026-38526

🔓 Krayin CRM v2.2.x - Exploit d'exécution de code à distance authentifiée ⚠️ POUR TESTS DE SÉCURITÉ AUTORISÉS UNIQUEMENT - Toute utilisation non autorisée est illégale et contraire à l'éthique. 📋 Aperçu Cet outil d'exploitation démontre une vulnérabilité critique d'exécution de code à distance RCE...

CVE-2026-38526-PoC

CVE-2026-38526 | Krayin CRM v2.2.x RCE authentifié - Téléversement de fichier PHP sans restriction via TinyMCE Description CVE-2026-38526 est une vulnérabilité critique d'exécution de code à distance authentifiée affectant Webkul Krayin CRM v2.2.x. La vulnérabilité réside dans le point de...

PoC-CVE-2026-38526

CVE-2026-38526 - RCE через загрузку PHP в Krayin CRM Автоматический эксплойт для Krayin CRM ≤ 2.2.x. Этот скрипт использует уязвимость неограниченной загрузки файлов в конечной точке TinyMCE /admin/tinymce/upload, обходит проверку MIME-типа, подделывая image/jpeg, загружает PHP-веб-шелл и выполня...

CVE-2026-47761

👋 Привет! Исследование безопасности 🛡️ CVE-2026-47761 – Исследователь безопасности Тип : Хранимый межсайтовый скриптинг XSS Продукт : TinyMCE Ссылки : CVE : https://nvd.nist.gov/vuln/detail/CVE-2026-47761 GHSA : https://github.com/tinymce/tinymce/security/advisories/GHSA-vg35-5wq7-3x7w Зал славы...

CVE-2026-38526-POC

CVE-2026-38526 - Krayin CRM RCE-эксплоит Krayin CRM ≤ 2.2.x - Неограниченная загрузка файлов, приводящая к удаленному выполнению кода. Этот PoC использует уязвимую конечную точку загрузки TinyMCE /admin/tinymce/upload для загрузки PHP-веб-шелла и выполнения команд на сервере. Возможности Полный...

CVE-2026-97897

A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 ...

CVE-2026-97897 Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting

A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 ...

EUVD-2026-87290

A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 ...

CVE-2026-97897

A security flaw exists in Krayin laravel-crm versions up to 2.2.5 . The vulnerability resides in the Sanitizer.php file of the TinyMCE Media Upload component, where improper processing allows for cross-site scripting (XSS) . This flaw can be triggered via a remote attack. To remediate this issue,...

CVE-2026-97897 Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting

A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 ...

CVE-2026-97897 Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting

A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 ...