CVE-2026-112193
Deferred Deferred - Pending Action

Weak Password Requirements in Webkul Aureus ERP

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description
A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacted is an unknown function of the file plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php. Performing a manipulation of the argument Password results in weak password requirements. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112193
EUVD
EUVD-2026-104479

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
Webkul Aureus ERP 1.0
Webkul Aureus ERP 1.1
Webkul Aureus ERP 1.2
Webkul Aureus ERP 1.3
Webkul Aureus ERP 1.4
Webkul Aureus ERP 1.5
Webkul Aureus ERP 1.6.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-521 The product does not require that users should have strong passwords.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-112193 is a weak password policy vulnerability in Webkul Aureus ERP up to version 1.6.0. The system only requires a minimum password length of 8 characters without enforcing complexity rules like uppercase, lowercase, numbers, or special characters. This allows users to set easily guessable passwords such as '12345678' or 'password'.

Detection Guidance

Check if AureusERP version 1.6.0 or earlier is installed by inspecting the file plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php for a password validation rule of only min:8 without additional complexity requirements.

Impact Analysis

An attacker could exploit this vulnerability by guessing weak passwords to gain unauthorized access to user accounts in the Aureus ERP system. This could lead to data breaches, unauthorized data manipulation, or other malicious activities depending on the privileges of the compromised account.

Compliance Impact

This vulnerability may violate compliance requirements under GDPR and HIPAA, which mandate strong password policies to protect sensitive personal and health data. Weak password policies increase the risk of unauthorized access, potentially leading to non-compliance with data protection regulations.

Mitigation Strategies

Update AureusERP to a version that enforces stronger password policies beyond just minimum length. If an update is unavailable, manually modify the password validation rules in UserForm.php to require uppercase, lowercase, numbers, and special characters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112193. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart