---
id: CVE-2026-112190
title: >-
  Webkul Aureus ERP composer.json insertion of sensitive information into
  debugging code
summary: >-
  A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0.
  This issue affects some unknown processing of the file composer.json. Such
  manipulation leads to insertion of sensitive information into debugging code.
  The att…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-215
  - CWE-200
vendor: Webkul
product: Aureus ERP
affected:
  - aureus_erp 1.0
  - aureus_erp 1.1
  - aureus_erp 1.2
  - aureus_erp 1.3
  - aureus_erp 1.4
  - aureus_erp 1.5
  - aureus_erp 1.6.0
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-19T18:30:46.682711Z'
exploitAvailable: true
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T18:30:56.708Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112190'
references:
  - url: 'https://vuldb.com/vuln/422295'
    label: >-
      VDB-422295 | Webkul Aureus ERP composer.json insertion of sensitive
      information into debugging code
  - url: 'https://vuldb.com/vuln/422295/cti'
    label: 'VDB-422295 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-112190'
    label: CVE-2026-112190 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/973094'
    label: 'Submit #973094 | Webkul Aureus ERP v1.6.0 Information Disclosure'
  - url: >-
      https://github.com/KaranParelkar/Auresus_vulnerability/blob/main/Information_Disclosure/Readme.md
tags:
  - cve.org
  - exploit-available
ingestedAt: '2026-10-19T17:33:42.477Z'
---

## Overview

A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some unknown processing of the file composer.json. Such manipulation leads to insertion of sensitive information into debugging code. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

## Affected

- `aureus_erp 1.0`
- `aureus_erp 1.1`
- `aureus_erp 1.2`
- `aureus_erp 1.3`
- `aureus_erp 1.4`
- `aureus_erp 1.5`
- `aureus_erp 1.6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.