CVE-2026-38526

PoC: CVE-2026-38526-PoC

CVE-2026-38526 | Krayin CRM v2.2.x Authenticated RCE - Unrestricted PHP File Upload via TinyMCE

[POC] GHSA-3mgp-fx93-9xv5 — CVE-2026-38526-POC

Proof of Concept of CVE-2026-38526 in Krayin CRM <= v2.2.x. Arbitrary File Upload leading to Remote Code Execution

PoC: CVE-2026-38526-Exploit

my version of an exploit for Krayin CRM v2.2.x - CVE-2026-38526

PoC: CVE-2026-38526-KrayinCRM-RCE

CVE-2026-38526 Exploit | by infrar3d

PoC: CVE-2026-38526

CVE-2026-38526 - Authenticated RCE exploit for Krayin CRM <= 2.2.x. Upload arbitrary PHP via /admin/tinymce/upload and gain remote code execution. Python PoC for security researchers, CTF players and bug bounty hunters. Tested on HTB Nexus.

PoC: CVE-2026-38526

CVE-2026-38526 - Authenticated RCE exploit for Krayin CRM <= 2.2.x. Upload arbitrary PHP via /admin/tinymce/upload and gain remote code execution. Python PoC for security researchers, CTF players and bug bounty hunters. Tested on HTB Nexus.

PoC: HTB-Nexus-walkthrough

Write-up машины Nexus (HTB). Цепочка атак: утечка данных в Git history → Krayin CRM RCE (CVE-2026-38526) → повышение привилегий через Git internals и SUID binary. Подробный разбор векторов атак с иллюстрациями.

PoC: CVE-2026-38526-KrayinCRM

Authenticated Arbitrary File Upload leading to Remote Code Execution Technical analysis and controlled reproduction of CVE-2026-38526 in Webkul Krayin CRM 2.2.x.

PoC: Gitea-template-sync-Path-Traversal-Privilege-Escalation-CVE-2026-38526-

PoC and write-up for the HackTheBox "Nexus" privilege escalation: root-run Gitea template-sync service vulnerable to path traversal via forged Git objects. Educational use only.

PoC: htb-labs-nexus

Hack The Box Nexus machine write-up covering reconnaissance, Gitea credential discovery, Krayin CRM exploitation via CVE-2026-38526, initial access, and privilege escalation through a vulnerable Gitea template synchronization service.

PoC: CVE-2026-38526-KrayinCRM-RCE

CVE-2026-38526 Exploit | by infrar3d

PoC: KrayinCRM-RCE-Exploit-CVE-2026-38526

CVE-2026-38526 exploit for Krayin CRM v2.2.x - Authenticated RCE via TinyMCE file upload bypass. Features interactive shell, multi-type payloads, auto shell generation, and verification. Author: Sudeepa Wanigarathna. For authorized testing only.

PoC: CVE-2026-38526-PoC-htb-nexus

A PoC script for CVE-2026-38526, RCE via a file upload vulnerability in the /admin/tinymce/upload endpoint of webkul krayin 2.2.x

PoC: CVE-2026-38526

Automated exploit for Krayin CRM ≤ 2.2.x.

PoC: CVE-2026-38526-Exploit

Exploit for Authenticated Remote Code Execution (RCE) in Krayin CRM v2.2.x (CVE-2026-38526)

PoC: Hack-The-Box-Nexus-Findings-Report

HTB_Nexus Penetration Test Report – Comprehensive security assessment documenting credential leakage from Gitea, CVE-2026-38526 exploitation in Krayin CRM, and privilege escalation via Gitea template sync directory traversal. Mapped to MITRE ATT&CK and NSA D3FEND frameworks with actionable remediation roadmap and full evidence appendix.