CVE-2026-104475: Idurar Idurar-ERP-CRM

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browsers when served from the /public route.

Affected products

• Idurar Idurar-ERP-CRM: up to and including 4.1.1

Published 2026-10-03. Last modified 2026-10-06.