CVE-2026-104475

IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browsers when served from the /public route.

  • Published Oct 3, 2026
  • CVSS 5.1 medium
  • 0.2% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-104475 at the National Vulnerability Database