CVE-2026-104475: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in idurar idurar-erp-crm
IDURAR ERP CRM versions up to 4.1.1 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users can upload SVG files with embedded JavaScript via profile update or settings upload endpoints. These malicious scripts execute in the browsers of users viewing the affected content served from the /public route. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.1.
AI Analysis
Technical Summary
CVE-2026-104475 is a stored cross-site scripting vulnerability in IDURAR ERP CRM through version 4.1.1. It arises from improper neutralization of input during web page generation, specifically allowing authenticated users to upload unsanitized SVG files containing JavaScript. These scripts execute in the context of victims' browsers when the SVGs are served from the /public route, potentially leading to script execution in users' sessions.
Potential Impact
The vulnerability allows authenticated users to inject and store malicious scripts that execute in other users' browsers when they access the affected SVG files. This can lead to unauthorized actions performed in the context of the victim's session, but the CVSS vector indicates low confidentiality, integrity, and availability impacts, consistent with a medium severity rating.
Mitigation Recommendations
No official patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict SVG file uploads or sanitize SVG content before allowing uploads to prevent script injection.
CVE-2026-104475: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in idurar idurar-erp-crm
Description
IDURAR ERP CRM versions up to 4.1.1 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users can upload SVG files with embedded JavaScript via profile update or settings upload endpoints. These malicious scripts execute in the browsers of users viewing the affected content served from the /public route. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.1.
CVSS v4.0
Score 5.1medium
Affected software
idurar
idurar-erp-crm
pkg:github/idurar/idurar-erp-crmRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-104475 is a stored cross-site scripting vulnerability in IDURAR ERP CRM through version 4.1.1. It arises from improper neutralization of input during web page generation, specifically allowing authenticated users to upload unsanitized SVG files containing JavaScript. These scripts execute in the context of victims' browsers when the SVGs are served from the /public route, potentially leading to script execution in users' sessions.
Potential Impact
The vulnerability allows authenticated users to inject and store malicious scripts that execute in other users' browsers when they access the affected SVG files. This can lead to unauthorized actions performed in the context of the victim's session, but the CVSS vector indicates low confidentiality, integrity, and availability impacts, consistent with a medium severity rating.
Mitigation Recommendations
No official patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict SVG file uploads or sanitize SVG content before allowing uploads to prevent script injection.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-02T00:55:58.387Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac03ed7a43b0b3b891276dd
Added to database: 10/02/2026, 23:31:35 UTC
Last enriched: 10/02/2026, 23:47:28 UTC
Last updated: 10/02/2026, 23:47:28 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.