Live › vulnerability › CVE-2026-112193
Go to dashboardAureus ERP up to version 1.6.0 has a flaw in its user form where the password argument is not checked against strong password requirements. An attacker who can reach the admin user creation or edit form could set or allow weak passwords, making account takeover easier.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Webkul Aureus ERP at version 1.6.0 or earlier with the security plugin's user management form exposed. Sources do not say whether a patched version exists. Installations that do not use this plugin or restrict user management to trusted staff are less exposed.
No product ranges from the sources yet.
1.6.0 or earlier if affected.plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php for password validation rules.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacted is an unknown function of the file plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php. Performing a manipulation of the argument Password results in weak password requirements. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-112193")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.