Sploitus

CVE-2026-38526

11 known exploits for CVE-2026-38526

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file.

Affected products
Krayin Crm
CVSS 3.1
9.9 CRITICAL
EPSS
3.8% (89th percentile)
Weakness
CWE-434
NVD status
Deferred
Published
2026-04-14
CVE-2026-38526 at NVD
Authoritative description, scoring and affected products

11 known exploits for CVE-2026-38526

Proof-of-concept code and exploit modules indexed by Sploitus

Exploit for CVE-2026-38526
2026-07-13 CerberusMrXiGITHUB
Exploit for CVE-2026-38526
2026-07-13 QurclincGITHUB
Exploit for CVE-2026-38526
2026-07-11 ResolvddGITHUB
Exploit for CVE-2026-38526
2026-07-11 ResolvddGITHUB
Krayin CRM v2.2.x - Authenticated Remote Code Execution
2026-07-08 DiamorphineEXPLOITDBPython
Exploit for CVE-2026-38526
2026-07-08 b0nyoGITHUB
Exploit for CVE-2026-38526
2026-07-06 diamorphine666GITHUB
Exploit for CVE-2026-38526
2026-07-06 mmoobbeeiidat-designGITHUB
Exploit for CVE-2026-38526
2026-06-24 pawpicGITHUB
Exploit for CVE-2026-38526
2026-05-16 NathanHimselfGITHUB
Security-Advisories
2026-04-13 TREXNEGROGITHUB