Medium severity5.4NVD Advisory· Published Oct 3, 2026

CVE-2026-104475

Description

IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browsers when served from the /public route.

Affected products

IDURAR/IDURARllm-fuzzy
Range: <=4.1.1

Patches

Vulnerability mechanics

References

github.com/idurar/idurar-erp-crm/blob/4.1.1/backend/src/middlewares/uploadMiddleware/utils/fileFilterMiddleware.jsnvd
github.com/idurar/idurar-erp-crm/issues/1414nvd
www.vulncheck.com/advisories/idurar-erp-crm-through-4.1.1-stored-xss-via-svg-uploadnvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000