CVE-2026-112193: medium-severity vulnerability in Webkul Aureus ERP
Webkul Aureus ERP UserForm.php weak password
Published · Updated
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.3epss 0.5%
exploitation probability
0.5%top 59% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacted is an unknown function of the file plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php. Performing a manipulation of the argument Password results in weak password requirements. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
Webkul · Aureus ERPpublic PoCs found — 1
cve_referencegithub.com/KaranParelkar/Auresus_vulnerability/blob/main/Weak%20Password%20Policy/Readme.mdunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Webkul Aureus ERP
In the same product, most dangerous first.
CVE-2026-95655HIGHAureus ERP before 1.5.0 Unscoped Message Access via ChatterPanelEPSS 0.5%CVE-2026-110218MEDIUMAureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URLEPSS 0.4%CVE-2026-94387MEDIUMAureus ERP before 1.6.0 Stored XSS via Chatter Field-Change LogEPSS 0.3%CVE-2026-112190MEDIUMWebkul Aureus ERP composer.json insertion of sensitive information into debugging codeEPSS 0.3%CVE-2026-93454MEDIUMAureus ERP through 1.6.0 Stored XSS via Payment Term NoteEPSS 0.3%CVE-2026-111284MEDIUMAureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action ModalEPSS 0.2%