CVE-2026-112190

MEDIUM 5.3

Webkul Aureus ERP composer.json insertion of sensitive information into debugging code

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some unknown processing of the file composer.json. Such manipulation leads to insertion of sensitive information into debugging code. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

CWE	CWE-215 CWE-200
Vendor	webkul
Product	aureus erp
Published	Oct 19, 2026
Last Updated	Oct 19, 2026

Stay Ahead of the Next One

Get instant alerts for webkul aureus erp

Be the first to know when new medium vulnerabilities affecting webkul aureus erp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Webkul / Aureus ERP

1.0 1.1 1.2 1.3 1.4 1.5 1.6.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/422295 vuldb.com: https://vuldb.com/vuln/422295/cti vuldb.com: https://vuldb.com/cve/CVE-2026-112190 vuldb.com: https://vuldb.com/submit/973094 github.com: https://github.com/KaranParelkar/Auresus_vulnerability/blob/main/Information_Disclosure/Readme.md

Credits

Karan Parelkar Devansh Sanghvi 🔍 Devansh33 (VulDB User) VulDB CNA Team