Is CVE-2026-104475 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-104475?

CVE-2026-104475 has a CVSS v3 severity of MEDIUM (5.4).

Back

CVE-2026-104475

Description

IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browsers when served from the /public route.