CVE-2026-112193

LowCVSS 3.7

Published: 19/10/2026(UTC)Updated: 22/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

29th percentile - higher than 29% of all known CVEs

Summary

A vulnerability was detected in Webkul Aureus ERP up to 1.6.0 in UserForm.php involving manipulation of the Password argument, resulting in weak password requirements. The exploit is publicly available and attack complexity is high.

Risk Assessment

An attacker could use the public exploit to weaken password policy, increasing the risk of account takeover. High attack complexity limits its prevalence.

Recommendation

Update Webkul Aureus ERP to a version later than 1.6.0 if available, or apply the vendor fix. Enforce strong password policy in configuration.

Other vulnerabilities in Webkul Aureus ERP

CVE-2026-112190Medium
A security vulnerability was detected in Webkul Aureus ERP up to 1.6.0 affecting unknown processing of composer.json that leads to insertion of sensitive information into debugging code. The attack may be launched remotely, the exploit has been publicly disclosed and may be used, and the vendor was contacted.

Original NVD description (English source)

A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacted is an unknown function of the file plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php. Performing a manipulation of the argument Password results in weak password requirements. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS