CVE-2026-38526
CRITICAL 9.9EPSS 2.4%
An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file.
- CVSS v3.1 MITRE
- 9.9 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - EPSS
- 2.35% chance of exploitation in the next 30 days, 83rd percentile
- Published
- 2026-04-14
Proof-of-concept exploits (13)
- TREXNEGRO/Security-Advisories/blob/main/CVE-2026-38526/poc.md9★ · 2026-06-15
- pawpic/CVE-2026-38526-POC1★ · 2026-06-26
- NathanHimself/CVE-2026-38526-PoC7★ · 2026-05-16
- diamorphine666/CVE-2026-38526-Exploit0★ · 2026-07-06
- CerberusMrXi/KrayinCRM-RCE-Exploit-CVE-2026-385263★ · 2026-07-14
- Qurclinc/CVE-2026-385260★ · 2026-07-13
- Industri4l-H3ll-Xpl0it3rs/CVE-2026-38526-KrayinCRM-RCE0★ · 2026-07-17
- b0nyo/PoC-CVE-2026-385260★ · 2026-07-09
- Resolvdd/CVE-2026-38526-PoC-htb-nexus1★ · 2026-07-19
- Shirouuu/Gitea-template-sync-Path-Traversal-Privilege-Escalation-CVE-2026-38526-1★ · 2026-09-14
- Harry178945/CVE-2026-385260★ · 2026-09-28
- MRdark-ops/CVE-2026-385260★ · 2026-09-28
- Ish3ng0m4/CVE-2026-38526-KrayinCRM/blob/b2ada245052976779dd791d588253a547bd59db1/poc/uplo…0★ · 2026-09-17