CVE-2023-52265: Idurarapp Idurar

Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days.

IDURAR (aka idurar-erp-crm) through 2.0.1 allows stored XSS via a PATCH request with a crafted JSON email template in the /api/email/update data.

Affected products

• Idurarapp Idurar: up to and including 2.0.1

Published 2023-12-30. Last modified 2026-06-17.