CVE-2026-112190: Webkul Aureus ERP composer.json insertion of sensitive information into debugging code
A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some unknown processing of the file composer.json. Such manipulation leads to insertion of sensitive information into debugging code. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
Affected Software
Event History
Frequently Asked Questions
Which deployments are potentially affected?
Webkul Aureus ERP versions up to and including 1.6.0 are identified as affected. The issue involves unknown processing of the composer.json file.
Does exploitation require authentication or user interaction?
No authentication or user interaction is indicated by the provided CVSS vector. The attack may be launched remotely with low attack complexity.
What is the expected impact?
The reported impact is limited to confidentiality: sensitive information may be inserted into debugging code and exposed. No integrity or availability impact is listed.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.