CVE-2026-112190
Deferred Deferred - Pending Action

Sensitive Information Exposure in Webkul Aureus ERP

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description
A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some unknown processing of the file composer.json. Such manipulation leads to insertion of sensitive information into debugging code. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112190
EUVD
EUVD-2026-104456

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
Webkul Aureus ERP 1.0
Webkul Aureus ERP 1.1
Webkul Aureus ERP 1.2
Webkul Aureus ERP 1.3
Webkul Aureus ERP 1.4
Webkul Aureus ERP 1.5
Webkul Aureus ERP 1.6.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-215 The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-112190 is an information disclosure vulnerability in Webkul Aureus ERP up to version 1.6.0. The issue occurs because debug mode is enabled by default (APP_DEBUG=true) and the Laravel Debugbar package is included as a production dependency. This allows the Debugbar toolbar to expose sensitive data like server paths, SQL queries with session IDs, PHP versions, and request/response headers on every page.

Detection Guidance

Check if APP_DEBUG=true is set in .env.example or .env.pgtest files. Look for the Laravel Debugbar package in composer.json production dependencies. Visit any page and inspect the Debugbar toolbar for exposed sensitive details like server paths, SQL queries, or session data.

Impact Analysis

An attacker could remotely access internal server details, raw SQL queries with bound data, session cookie values, and framework versions without authentication. This information could enable further attacks such as session prediction or reconnaissance, potentially leading to unauthorized access or data breaches.

Compliance Impact

This vulnerability exposes sensitive information such as session cookies, SQL queries with bound data, server paths, and framework versions. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. Unauthorized access to such data could lead to compliance violations due to insufficient protection of sensitive information.

Mitigation Strategies

Set APP_DEBUG=false in all configuration files. Move Laravel Debugbar from production to development dependencies in composer.json. Restart the application to apply changes and verify debug mode is disabled.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112190. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart