CVE-2026-104475 — IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers…
Published: 2026-10-02 · CVSS: 5.1 · CVSS 4.0
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browsers when served from the /public route.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7