All vulnerabilities
CVE-2026-104475

idurar-erp-crm: IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload

idurar idurar-erp-crm
Open in ThreatlineRecord JSON
CVSS
5.1Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 6 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published2 Oct 2026Updated 6 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browsers when served from the /public route.

Text from CVE List

Affected versions 1

  • idurar-erp-crmaffected: all versions through 4.1.1CVE List

References 4