CVE-2026-84148

This vulnerability in the ERP system is due to unsafe deserialization of user-controlled data in the affected functionality. An unauthenticated remote attacker could exploit this by supplying specially crafted data to the vulnerable functionality.

This vulnerability in the ERP system is due to insufficient validation and parameterization of user-supplied input in an API endpoint. An unauthenticated remote attacker could exploit this by supplying specially crafted input to the vulnerable endpoint.

This vulnerability in the ERP system is due to improper validation of payment callback parameters and inadequate authentication controls in an API endpoint. An unauthenticated remote attacker could exploit this by manipulating the parameter to cause the application to establish an authenticated session for an arbitrary user without valid payment verification.

This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated attacker could retrieve repository metadata and files, potentially reconstructing the application's source code.

This vulnerability exists in the ERP system due to improper authentication controls and inadequate file type validation at the API endpoint. An unauthenticated attacker could upload arbitrary files to a web accessible directory, potentially executing arbitrary code and compromising the system.