Idurar vulnerabilities
We track 3 vulnerabilities in Idurar products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 26, 2026.
Latest Idurar vulnerabilities
- 7.2 High severity
idurar-erp-crm: Authorization Bypass Through User-Controlled Key
IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user fro
- 7.5 High severity
IDURAR ERP CRM: Improper Access Control
A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publ
- 7.5 High severity
idurar-erp-crm: Improper Limitation of a Pathname to a Restricted Directory
IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is identified that the public endpoint is accessible to an unauthenticated user. The user's input is direc