CVE-2026-38526
Published
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.9epss 2.4%
from disclosure to weapon32 days
Published on NVDApr 14
1st PoC+32d
exploitation probability
2.4%top 17% of all CVEs
observed exploitation
nono source reports it
17 public exploit(s)
An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N
Affected products
n/a · n/apublic PoCs found — 17
exploitdbwww.exploit-db.com/exploits/52629unverifiedgithubgithub.com/NathanHimself/CVE-2026-38526-PoC★ 7githubgithub.com/CerberusMrXi/KrayinCRM-RCE-Exploit-CVE-2026-38526★ 3githubgithub.com/Shirouuu/Gitea-template-sync-Path-Traversal-Privilege-Escalation-CVE-2026-38526-★ 1githubgithub.com/pawpic/CVE-2026-38526-POC★ 1githubgithub.com/Resolvdd/CVE-2026-38526-PoC-htb-nexus★ 1githubgithub.com/DiegoRivas1/htb-labs-nexus★ 0githubgithub.com/mmoobbeeiidat-design/Hack-The-Box-Nexus-Findings-Report★ 0githubgithub.com/Industri4l-H3ll-Xpl0it3rs/CVE-2026-38526-KrayinCRM-RCE★ 0githubgithub.com/Ish3ng0m4/CVE-2026-38526-KrayinCRM★ 0githubgithub.com/diamorphine666/CVE-2026-38526-Exploit★ 0githubgithub.com/b0nyo/CVE-2026-38526★ 0githubgithub.com/Qurclinc/CVE-2026-38526★ 0githubgithub.com/b0nyo/PoC-CVE-2026-38526★ 0githubgithub.com/Harry178945/CVE-2026-38526★ 0githubgithub.com/MRdark-ops/CVE-2026-38526★ 0cve_referencegithub.com/TREXNEGRO/Security-Advisories/blob/main/CVE-2026-38526/poc.mdunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.