CVE-2026-104475

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-03

Last updated on: 2026-10-06

Assigner: VulnCheck

Description

IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browsers when served from the /public route.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-03

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-03

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104475

EUVD

EUVD-2026-91851

Affected Vendors & Products

Vendor	Product	Version / Range
idurar	idurar-erp-crm	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in IDURAR ERP CRM through version 4.1.1. Authenticated users can upload malicious SVG files containing JavaScript code via profile update or settings upload endpoints. When these files are served from the /public route, the embedded scripts execute in victims' browsers.

Detection Guidance

Check for unauthorized SVG uploads in the /public route or profile settings. Inspect network traffic for POST requests to /api/admin/profile/update or /api/setting/upload/:settingKey with SVG files containing script tags. Review server logs for files served from /public with suspicious JavaScript execution.

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of users, or redirect users to malicious sites. Users with access to the ERP system could unknowingly execute harmful scripts when viewing profiles or settings containing infected SVG files.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may expose protected health information if user sessions are hijacked. Both standards require protection against such injection attacks.

Mitigation Strategies

Disable SVG uploads temporarily or implement strict MIME type validation to block non-image SVG files. Sanitize uploaded SVGs using libraries like DOMPurify or svg-hash. Apply Content-Security-Policy headers to block inline scripts. Update to a patched version if available.

Hi! I’m here to help you understand CVE-2026-104475. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70