CVE-2026-104475

Name of the Vulnerable Software and Affected Versions IDURAR ERP CRM versions prior to 4.1.2

Description Authenticated users can perform stored cross-site scripting by uploading unsanitized SVG files. This occurs when JavaScript-laden SVGs are uploaded via the profile update or settings upload endpoints and subsequently executed in the browsers of victims when accessed through the /public route.

Recommendations Update IDURAR ERP CRM to version 4.1.2 or later. Restrict the upload of SVG files to the profile update and settings upload endpoints as a temporary mitigation.