CVE-2026-104475

MediumCVSS 5.4

Published: 03/10/2026(UTC)Translated: 03/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browsers when served from the /public route.

Risk Assessment

An authenticated user can execute arbitrary JavaScript in other users' browsers, potentially leading to session theft or actions on behalf of the victim. This may result in takeover of privileged accounts.

Recommendation

Update IDURAR ERP CRM to a version later than 4.1.1. Restrict SVG file uploads or sanitize them.

Other vulnerabilities in IDURAR ERP CRM

CVE-2026-81031High
IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler resolves the authenticated user from the token but issues the update against a filter built from the URL identifier, without comparing them. The route is behind an administrator token check only, so any admin session suffices. The sole guard rejects a single hardcoded demo address. An attacker can set an arbitrary password on any other admin account and sign in as it.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS