Threat database

IDURAR ERP CRM versions up to 4.1.1 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users can upload SVG files containing malicious JavaScript via profile update or settings upload endpoints. These scripts execute in the browsers of other users when the SVGs are served from the /public route. The vulnerability has a medium severity with a CVSS 4.0 score of 5.1.

CVE-2026-81031 is a high-severity authorization bypass vulnerability in idurar-erp-crm versions up to and including 4.1.1. It allows any valid administrator session to change the password of any other administrator account by specifying the target account identifier in the request URL. The update handler does not verify that the authenticated user matches the account being updated, enabling arbitrary password changes and potential account takeover.

A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can enumerate MongoDB ObjectIds to download any invoice in the system without credentials.