CVE-2026-112193: Webkul Aureus ERP UserForm.php weak password
A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacted is an unknown function of the file plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php. Performing a manipulation of the argument Password results in weak password requirements. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
Affected Software
Event History
Frequently Asked Questions
What access would an attacker need to attempt exploitation?
The available vector indicates the issue can be attempted remotely without prior privileges or user interaction. However, the attack complexity is rated high and exploitation is considered difficult.
Which installations should be considered potentially affected?
Webkul Aureus ERP versions up to and including 1.6.0 are identified as affected. The available information does not specify configuration conditions or whether any particular deployment setup is excluded.
Is exploit code available publicly?
Yes. The exploit is reported as public and may be used, despite the stated high attack complexity.