Skip to content
OpenAdvisories

Vendor

idurar

4 known vulnerabilities.

Products

idurar-erp-crm 4
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.2
    CVE-2026-81031

    IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update

    IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user fr…

    idurar idurar-erp-crm
  • High 7.5
    CVE-2026-72600

    Idurar IDURAR ERP CRM - Broken Access Control

    A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it pub…

    idurar idurar-erp-crm
  • High 7.5
    CVE-2024-47769

    IDURAR has a Path Traversal (unauthenticated user can read sensitive data)

    IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is identified that the public endpoint is accessible to an unauthenticated user. The user's input is dire…

    idurar idurar-erp-crm