41 matches found
CVE-2026-72600
A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can...
EUVD-2026-56039
A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can...
CVE-2026-72600 Idurar IDURAR ERP CRM - Broken Access Control
A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can...
CVE-2026-72600
Idurar IDURAR ERP CRM 4.1.0 contains a broken access control vulnerability that allows unauthenticated remote attackers to download invoice PDFs containing customer PII via the /download route. The router is mounted without authentication middleware, enabling public access, and an attacker can en...
CVE-2026-72600 Idurar IDURAR ERP CRM - Broken Access Control
A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can...
CVE-2026-72600
A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can...
EUVD-2024-42680
Malicious code in bioql PyPI...
EUVD-2023-31478
Malicious code in bioql PyPI...
CVE-2024-25164
iA Path Traversal vulnerability exists in iDURAR v2.0.0, that allows unauthenticated attackers to expose sensitive files via the download functionality...
CVE-2023-27742
IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login...
CVE-2024-47769
IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is identified that the public endpoint is accessible to an unauthenticated user. The user's input is directly appended to the join statement...
CVE-2024-47769
IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is identified that the public endpoint is accessible to an unauthenticated user. The user's input is directly appended to the join statement...
CVE-2024-47769
Summary: CVE-2024-47769 affects IDURAR, an open-source ERP/CRM. The vulnerability is in corePublicRouter.js where a public endpoint is accessible to unauthenticated users and user input is directly appended to a join statement, enabling a URL-encoded payload to be processed. This can allow an att...
CVE-2024-47769 IDURAR has a Path Traversal (unauthenticated user can read sensitive data)
IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is identified that the public endpoint is accessible to an unauthenticated user. The user's input is directly appended to the join statement...
CVE-2024-47769 IDURAR has a Path Traversal (unauthenticated user can read sensitive data)
IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is identified that the public endpoint is accessible to an unauthenticated user. The user's input is directly appended to the join statement...
CVE-2024-47769 IDURAR has a Path Traversal (unauthenticated user can read sensitive data)
IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is identified that the public endpoint is accessible to an unauthenticated user. The user's input is directly appended to the join statement...
IDURAR ERP/CRM 安全漏洞
IDURAR ERP/CRM is an open source content management system from the individual developer Salah Eddine Lalami. A security vulnerability exists in IDURAR ERP/CRM versions prior to 2.1.0 that stems from the presence of a path traversal vulnerability, which allows an attacker to send a URL-encoded...
CVE-2024-25164
iA Path Traversal vulnerability exists in iDURAR v2.0.0, that allows unauthenticated attackers to expose sensitive files via the download functionality...
Path traversal
iA Path Traversal vulnerability exists in iDURAR v2.0.0, that allows unauthenticated attackers to expose sensitive files via the download functionality...
IDURAR ERP/CRM Security Breach
IDURAR ERP/CRM is an open source content management system by Salah Eddine Lalami, an individual developer. A security vulnerability exists in IDURAR ERP/CRM v2.0.0, which stems from a path traversal vulnerability that can be exploited by an attacker to expose sensitive files via the download...