CVE-2026-6651

LowCVSS 2.4/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in erponline.xyz ERP Online up to 4.0.0. This vulnerability affects unknown code of the component Inventory Edit Item Page. The manipulation of the argument Item Name results in cross site scripting. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 2.4/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Apr 20, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-66524.7A weakness has been identified in Pagekit CMS up to 1.0.18. This issue affects the function evaluate of the file app/modules/view/src/PhpEng CVE-2026-66539.8Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of CVE-2026-66545.1Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_pl CVE-2026-66567.5Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The check_password method uses the built-in eq operator. CVE-2026-665639.8Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.CVE-2026-665649.8Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.CVE-2026-665659.8Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.CVE-2026-665668.1Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.CVE-2026-665679.8Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.CVE-2026-665689.8Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.CVE-2026-665699.8Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.CVE-2026-66578.8A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_