{"id":"CVE-2026-112190","kind":"vulnerability","aliases":["CVE-2026-112190"],"related":[],"title":"Webkul Aureus ERP: composer.json processing leaks sensitive data into debug output","description":"A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some unknown processing of the file composer.json. Such manipulation leads to insertion of sensitive information into debugging code. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.","summary":"Webkul Aureus ERP up to 1.6.0 mishandles the composer.json file, which inserts sensitive information into debugging code. A remote attacker can read that leaked data, though the sources do not say exactly what data is exposed.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","other","php","self-hosted"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-19T17:17:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:12:47+00:00","updated_at":"2026-10-25T04:12:47+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T04:12:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Webkul Aureus ERP: composer.json processing leaks sensitive data into debug output","impact":"low","summary":"Webkul Aureus ERP up to 1.6.0 mishandles the composer.json file, which inserts sensitive information into debugging code. A remote attacker can read that leaked data, though the sources do not say exactly what data is exposed.","category":"other","nicknames":[],"who_cares":["erp","php","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Sensitive information leaks through debug code to a remote attacker","analyst_note":"Find the vendor advisory or the Webkul Aureus ERP 1.6.0 changelog to confirm the fixed version, the leaked data and whether a debug setting is required; source is NVD only.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00052,"input_tokens":3331,"output_tokens":374,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112190':14A,17A '-2026':13A,16A '1.6.0':29B,72C 'affect':75C 'attack':43B,95C 'aureus':2A,25B,68C 'code':40B,93C 'composer.json':4A,32B,82C 'contact':113C 'cve':12A,15A 'data':8A,48B,57B 'debug':10A,39B,92C 'detect':65C 'disclos':104C 'disclosur':117C 'earli':114C 'erp':3A,18B,26B,69C 'exact':55B 'exploit':101C 'expos':59B 'file':33B,81C 'host':23B 'inform':37B,90C 'insert':35B,87C 'issu':74C 'launch':98C 'lead':85C 'leak':6A,47B 'manipul':84C 'may':96C,107C 'mishandl':30B 'output':11A 'php':20B 'process':5A,78C 'public':105C 'read':45B 'remot':42B,99C 'say':54B 'secur':61C 'self':22B 'self-host':21B 'sensit':7A,36B,89C 'sourc':51B 'though':49B 'unknown':77C 'use':109C 'vendor':111C 'vulner':62C 'webkul':1A,24B,67C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112190","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112190","severity":null,"published_at":"2026-10-19T17:17:14+00:00","modified_at":"2026-10-19T19:17:26+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}