CVE-2026-38526
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.9epss 3.8%
from disclosure to weapon32 days
Published on NVDApr 14
1st PoC+32d
exploitation probability
3.8%top 11% of all CVEs
observed exploitation
nono source reports it
12 public exploit(s)
An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N
Affected products
n/a · n/apublic PoCs found — 12
exploitdbwww.exploit-db.com/exploits/52629unverifiedgithubgithub.com/NathanHimself/CVE-2026-38526-PoC★ 4githubgithub.com/CerberusMrXi/KrayinCRM-RCE-Exploit-CVE-2026-38526★ 3githubgithub.com/pawpic/CVE-2026-38526-POC★ 0githubgithub.com/Resolvdd/CVE-2026-38526-PoC-htb-nexus★ 0githubgithub.com/Qurclinc/CVE-2026-38526★ 0githubgithub.com/b0nyo/CVE-2026-38526★ 0githubgithub.com/b0nyo/PoC-CVE-2026-38526★ 0githubgithub.com/Industri4l-H3ll-Xpl0it3rs/CVE-2026-38526-KrayinCRM-RCE★ 0githubgithub.com/diamorphine666/CVE-2026-38526-Exploit★ 0githubgithub.com/mmoobbeeiidat-design/Hack-The-Box-Nexus-Findings-Report★ 0cve_referencegithub.com/TREXNEGRO/Security-Advisories/blob/main/CVE-2026-38526/poc.mdunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.