Description
An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Krayin CRM v2.2.x - Authenticated Remote Code Execution EDB-52629 · webapps · Jul 8, 2026
GitHub 14 repositories · most starred shown
-
NathanHimself/CVE-2026-38526-PoC ★ 7 · May 16, 2026
CVE-2026-38526 | Krayin CRM v2.2.x Authenticated RCE - Unrestricted PHP File Upload via TinyMCE
-
CerberusMrXi/KrayinCRM-RCE-Exploit-CVE-2026-38526 ★ 3 · Jul 13, 2026
CVE-2026-38526 exploit for Krayin CRM v2.2.x - Authenticated RCE via TinyMCE file upload bypass. Features interactive shell, multi-type payloads, auto shell generation, and verification. Author: Sude…
-
sh3llc0d3-0x15/CVE-2026-38526-Exploit ★ 1 · Oct 24, 2026
my version of an exploit for Krayin CRM v2.2.x - CVE-2026-38526
-
PoC and write-up for the HackTheBox "Nexus" privilege escalation: root-run Gitea template-sync service vulnerable to path traversal via forged Git objects. Educational use only.
-
Resolvdd/CVE-2026-38526-PoC-htb-nexus ★ 1 · Jul 11, 2026
A PoC script for CVE-2026-38526, RCE via a file upload vulnerability in the /admin/tinymce/upload endpoint of webkul krayin 2.2.x
-
pawpic/CVE-2026-38526-POC ★ 1 · Jun 24, 2026
Proof of Concept of CVE-2026-38526 in Krayin CRM <= v2.2.x. Arbitrary File Upload leading to Remote Code Execution
-
Qurclinc/CVE-2026-38526 ★ 0 · Jul 13, 2026
-
b0nyo/PoC-CVE-2026-38526 ★ 0 · Jul 8, 2026
Automated exploit for Krayin CRM ≤ 2.2.x.
-
diamorphine666/CVE-2026-38526-Exploit ★ 0 · Jul 6, 2026
Exploit for Authenticated Remote Code Execution (RCE) in Krayin CRM v2.2.x (CVE-2026-38526)
-
mmoobbeeiidat-design/Hack-The-Box-Nexus-Findings-Report ★ 0 · Jul 6, 2026
HTB_Nexus Penetration Test Report – Comprehensive security assessment documenting credential leakage from Gitea, CVE-2026-38526 exploitation in Krayin CRM, and privilege escalation via Gitea template…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.