Threat database

CVE-2026-22789 is a medium-severity vulnerability in SMEWebify's WebErpMesv2 versions prior to 1.19 that allows authenticated users to bypass file upload validation and upload arbitrary files, including PHP scripts. This can lead to remote code execution (RCE) on the affected system. The flaw exists in multiple controllers and is similar to CVE-2025-52130 but in different code locations not fixed previously. Exploitation requires authentication but no user interaction beyond that. The vulnerability impacts confidentiality and integrity but not availability, with a CVSS score of 5.4. No known exploits are currently reported in the wild. European organizations using WebErpMesv2 in manufacturing or resource management should prioritize upgrading to version 1.19 or later to mitigate risk.

CVE-2026-22788 is a high-severity vulnerability in SMEWebify's WebErpMesv2 versions prior to 1.19, where multiple sensitive API endpoints lack authentication. This allows unauthenticated remote attackers to access critical business data such as companies, quotes, orders, tasks, and whiteboards. Attackers can also perform limited write operations, including creating company records and fully manipulating collaboration whiteboards. The vulnerability does not require user interaction or authentication and has a CVSS score of 8.2, indicating a significant risk to confidentiality and partial impact on integrity. The issue is resolved in version 1.19. European organizations using affected versions face risks of data exposure and unauthorized data manipulation, especially in manufacturing and resource management sectors. Mitigation involves immediate upgrading to version 1.