CVE-2026-110218: falha de média gravidade em Webkul Aureus ERP
Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL
Publicada em · Atualizada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.3epss 0.4%
probabilidade de exploração
0.4%top 71% das CVEs
exploração observada
nãonenhuma fonte reporta
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts via the customer-facing post view page. Attackers who know or guess a post slug can retrieve the full title, content, image, tags, author and publish date because PostResource skips authorization and ViewPost ignores is_published.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Webkul · Aureus ERPCVEs relacionadas — Webkul Aureus ERP
No mesmo produto, das mais perigosas para as menos.
CVE-2026-95655HIGHAureus ERP before 1.5.0 Unscoped Message Access via ChatterPanelEPSS 0.5%CVE-2026-112193MEDIUMWebkul Aureus ERP UserForm.php weak passwordEPSS 0.5%CVE-2026-94387MEDIUMAureus ERP before 1.6.0 Stored XSS via Chatter Field-Change LogEPSS 0.3%CVE-2026-112190MEDIUMWebkul Aureus ERP composer.json insertion of sensitive information into debugging codeEPSS 0.3%CVE-2026-93454MEDIUMAureus ERP through 1.6.0 Stored XSS via Payment Term NoteEPSS 0.3%CVE-2026-111284MEDIUMAureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action ModalEPSS 0.2%
Referências
https://github.com/aureuserp/aureuserphttps://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/blogs/src/Filament/Customer/Resources/PostResource/Pages/ViewPost.php#L9-L24https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/blogs/src/Filament/Customer/Resources/PostResource.php#L23https://github.com/aureuserp/aureuserp/releases/tag/v1.6.0https://hackmd.io/@leediay/ryPaE-t9flhttps://www.vulncheck.com/advisories/aureus-erp-through-1.6.0-unpublished-blog-post-disclosure-via-direct-url