Threat database

IDURAR ERP CRM versions up to 4.1.1 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users can upload SVG files containing malicious JavaScript via profile update or settings upload endpoints. These scripts execute in the browsers of other users when the SVGs are served from the /public route. The vulnerability has a medium severity with a CVSS 4.0 score of 5.1.

CVE-2026-81031 is a high-severity authorization bypass vulnerability in idurar-erp-crm versions up to and including 4.1.1. It allows any valid administrator session to change the password of any other administrator account by specifying the target account identifier in the request URL. The update handler does not verify that the authenticated user matches the account being updated, enabling arbitrary password changes and potential account takeover.

iA Path Traversal vulnerability exists in iDURAR v2.0.0, that allows unauthenticated attackers to expose sensitive files via the download functionality.