Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7 results
Oct 2, 2026IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVGCVE-2026-104475 · Other software · idurar · reported by VulnCheckMedium 5.1
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browsers when served from the /public route.
- Product
- idurar-erp-crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request.CVE-2026-81031 · Other software · idurar · reported by VulnCheckHigh 8.6
IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middleware populated, then issues its update against a filter built from the identifier in the URL path, and never compares the two. The route is mounted behind the administrator token check only, so any valid administrator session is sufficient, and the sole ownership-like guard in the handler rejects a single hardcoded demo address. A caller can therefore set an arbitrary password on any other administrator account and sign in as it. The read handler in the same controller directory accepts an identifier the same way, which supplies the identifiers needed to pick a target.
- Product
- idurar-erp-crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PCVE-2026-72600 · Other software · Idurar · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.5
A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can enumerate MongoDB ObjectIds to download any invoice in the system without credentials.
- Product
- IDURAR ERP CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2024IDURAR is open source ERP CRM accounting invoicing software.CVE-2024-47769 · Other software · idurar · reported by GitHubHigh 7.5
IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is identified that the public endpoint is accessible to an unauthenticated user. The user's input is directly appended to the join statement without additional checks. This allows an attacker to send URL encoded malicious payload. The directory structure can be escaped to read system files by adding an encoded string (payload) at subpath location.
- Product
- idurar-erp-crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2024iA Path Traversal vulnerability exists in iDURAR v2.0.0, that allows unauthenticated attackers to expose sensitive files via the download functionality.CVE-2024-25164 · Other software · idurar_project · reported by MITREHigh 7.5
iA Path Traversal vulnerability exists in iDURAR v2.0.0, that allows unauthenticated attackers to expose sensitive files via the download functionality.
- Product
- idurar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2023IDURAR (aka idurar-erp-crm) through 2.0.1 allows stored XSS via a PATCH request with a crafted JSON email template in the /api/email/update data.CVE-2023-52265 · Other software · Idurarapp · reported by MITREMedium 5.4
IDURAR (aka idurar-erp-crm) through 2.0.1 allows stored XSS via a PATCH request with a crafted JSON email template in the /api/email/update data.
- Product
- Idurar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2023IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login.CVE-2023-27742 · Other software · Idurarapp · reported by MITRECritical 9.8
IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login.
- Product
- Idurar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.