CVE-2026-112190: fallo de gravedad media en Webkul Aureus ERP
Webkul Aureus ERP composer.json insertion of sensitive information into debugging code
Publicada el
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 6.9epss 0.3%
probabilidad de explotación
0.3%top 77% de las CVE
explotación observada
noninguna fuente lo reporta
1 exploit(s) público(s)
A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some unknown processing of the file composer.json. Such manipulation leads to insertion of sensitive information into debugging code. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Productos afectados
Webkul · Aureus ERPPoCs públicas encontradas — 1
cve_referencegithub.com/KaranParelkar/Auresus_vulnerability/blob/main/Information_Disclosure/Readme.mdno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Webkul Aureus ERP
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-95655HIGHAureus ERP before 1.5.0 Unscoped Message Access via ChatterPanelEPSS 0.5%CVE-2026-112193MEDIUMWebkul Aureus ERP UserForm.php weak passwordEPSS 0.5%CVE-2026-110218MEDIUMAureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URLEPSS 0.4%CVE-2026-94387MEDIUMAureus ERP before 1.6.0 Stored XSS via Chatter Field-Change LogEPSS 0.3%CVE-2026-93454MEDIUMAureus ERP through 1.6.0 Stored XSS via Payment Term NoteEPSS 0.3%CVE-2026-111284MEDIUMAureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action ModalEPSS 0.2%