CVE-2026-72600

A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can...

EUVD-2026-56039

A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can...

CVE-2026-72600

A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can...

CVE-2026-72600

Idurar IDURAR ERP CRM 4.1.0 contains a broken access control vulnerability that allows unauthenticated remote attackers to download invoice PDFs containing customer PII via the /download route. The router is mounted without authentication middleware, enabling public access, and an attacker can en...

PT-2026-70144

Name of the Vulnerable Software and Affected Versions Idurar IDURAR ERP CRM version 4.1.0 Description A broken access control issue allows unauthenticated remote attackers to download invoice PDF files containing customer personally identifiable information PII. This occurs because the '/download...

EUVD-2023-31478

Malicious code in bioql PyPI...

CVE-2023-27742

IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login...

IDURAR ERP/CRM 安全漏洞

IDURAR ERP/CRM is an open source content management system from the individual developer Salah Eddine Lalami. A security vulnerability exists in IDURAR ERP/CRM versions prior to 2.1.0 that stems from the presence of a path traversal vulnerability, which allows an attacker to send a URL-encoded...

IDURAR ERP/CRM Cross-Site Scripting Vulnerability

IDURAR ERP/CRM is an open source content management system from the individual developer Salah Eddine Lalami. A cross-site scripting vulnerability exists in IDURAR ERP/CRM 2.0.1 and prior versions, which originates from the ability to execute cross-site scripting via the Edit Email Template featu...

CVE-2023-27742

IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login...

CVE-2023-27742

IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login...

Sql injection

IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login...

PT-2023-21313 · Unknown · Idurar Erp/Crm

Name of the Vulnerable Software and Affected Versions: IDURAR ERP/CRM version 1 Description: The issue is related to a SQL injection vulnerability. It affects the /api/login component. Recommendations: For IDURAR ERP/CRM version 1, consider restricting access to the /api/login endpoint until a...

IDURAR ERP/CRM SQL注入漏洞

IDURAR ERP/CRM is an open source content management system by Salah Eddine Lalami Individual Developer. A security vulnerability exists in IDURAR ERP/CRM v1, which was discovered to contain an SQL injection vulnerability via components/api/login...

CVE-2023-27742

IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login...