All vulnerabilities
CVE-2026-38526

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file.

n/a n/a
Open in ThreatlineRecord JSON
CVSS
9.9Critical
ExploitationPublic exploit codeWebapps exploit, 8 Jul 2026. Not in the KEV catalogExploit-DB
Exploit odds (EPSS)2.35%Chance of exploitation activity in the next 30 days, higher than 83% of CVEs. Scored 24 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published14 Apr 2026Updated 14 Apr 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

  1. 14 Apr 2026, 00:00 UTCPublishedCVE List
  2. 8 Jul 2026Exploit code publicExploit-DB

Public exploit code and templates 1

  • Webapps exploitKrayin CRM v2.2.x - Authenticated Remote Code Execution 8 Jul 2026Exploit-DB

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Affected versions 1

  • n/aaffected: n/aCVE List

References 3