Webkul Aureus ERP EUVD-2026-104456

Exploitation requires that the Aureus ERP instance (version up to 1.6.0) expose the composer.json file or associated debugging/metadata output to the attacker over the network; the flaw is sensitive information inserted into debugging code (CWE-215) reachable via that file. Per the CVSS 4.0 vector no authentication (PR:N) and no user interaction (UI:N) are needed, so a default internet-facing deployment that serves this file/debug path is sufficient. Limiting factors: impact is confined to confidentiality disclosure (VC:L, no integrity/availability effect), the exposed data must actually contain sensitive values to be useful, and the product's small deployment footprint restricts the realistic target set; instances where the file/debug output is not web-reachable are not exploitable.

This is a low-to-moderate real-world risk that should rank below genuinely urgent items despite being remotely reachable. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes an unauthenticated, low-complexity, remote vector, but the only impact is low confidentiality (VC:L) with no integrity or availability effect (VI:N/VA:N) and no scope change - consistent with CWE-215 (sensitive information in debugging code) exposed via composer.json. The vector carries E:P (Proof-of-Concept exploit maturity), which aligns with the reported publicly available exploit, so exploitability is credible but not confirmed as active. No EPSS score was provided and the CVE is NOT in CISA KEV, so there is no signal of widespread or confirmed in-the-wild exploitation; the publicly available PoC indicates opportunistic rather than confirmed campaign use. Net: a legitimate but bounded information-disclosure issue - easy to reach, but limited blast radius (confidentiality-only, low) and a niche product footprint keep it off the top-priority tier. Conflicting-signal note: the input supplies only a CVSS 4.0 vector (no 3.1), and no EPSS, so automatability and real exploitation frequency cannot be derived from the data - treat exploitation likelihood as inferred from PoC existence only.

A remote, unauthenticated attacker requests or inspects the exposed composer.json (or associated debug output) on an internet-facing Aureus ERP instance and reads sensitive information left in debugging/metadata that was not meant to be public. A public proof-of-concept for this disclosure exists on GitHub, lowering the skill needed to reproduce it. The attacker uses the leaked details for reconnaissance or to inform follow-on attacks rather than for direct compromise.