CVE-2026-112190

MediumCVSS 5.3/10Last modified Oct 19, 2026

Description

A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some unknown processing of the file composer.json. Such manipulation leads to insertion of sensitive information into debugging code. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-215

Affected software

No affected versions have been published.

Timeline

Published: Oct 19, 2026
Last modified: Oct 19, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1121925.3MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumpti CVE-2026-1121933.7A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacted is an unknown function of the file plugins/webkul/security/src/Filam CVE-2026-1121954.7A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5. The affected element is an unknown function of the file app/dialplans/resources/CVE-2026-1121996.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-wo CVE-2026-11229.8A vulnerability was determined in Yonyou KSOA 9.0. This impacts an unknown function of the file /worksheet/work_info.jsp of the component HT CVE-2026-112206.5Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromis CVE-2026-112202Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With `gif_consolidate => 1`, pale CVE-2026-1122077.1The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it cli CVE-2026-112214.3Insufficient validation of untrusted input in PointerLock in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromi CVE-2026-1122106.0A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a CVE-2026-1122127.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 th CVE-2026-1122146.5A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is