CVE-2026-112190: falha de média gravidade em Webkul Aureus ERP
Webkul Aureus ERP composer.json insertion of sensitive information into debugging code
Publicada em
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 6.9epss 0.3%
probabilidade de exploração
0.3%top 77% das CVEs
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some unknown processing of the file composer.json. Such manipulation leads to insertion of sensitive information into debugging code. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Produtos afetados
Webkul · Aureus ERPPoCs públicas encontradas — 1
cve_referencegithub.com/KaranParelkar/Auresus_vulnerability/blob/main/Information_Disclosure/Readme.mdnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Webkul Aureus ERP
No mesmo produto, das mais perigosas para as menos.
CVE-2026-95655HIGHAureus ERP before 1.5.0 Unscoped Message Access via ChatterPanelEPSS 0.5%CVE-2026-112193MEDIUMWebkul Aureus ERP UserForm.php weak passwordEPSS 0.5%CVE-2026-110218MEDIUMAureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URLEPSS 0.4%CVE-2026-94387MEDIUMAureus ERP before 1.6.0 Stored XSS via Chatter Field-Change LogEPSS 0.3%CVE-2026-93454MEDIUMAureus ERP through 1.6.0 Stored XSS via Payment Term NoteEPSS 0.3%CVE-2026-111284MEDIUMAureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action ModalEPSS 0.2%