Manacle Technologies
Monthly
Unauthenticated remote code execution in Manacle Multi-Tenant ERP allows attackers to execute arbitrary code or manipulate application data through unsafe deserialization of user-controlled input (CWE-502). The vulnerability (CVE-2026-107104) is rated critical with a CVSS 4.0 score of 9.3 and requires no privileges or user interaction to exploit (PR:N/UI:N). No public exploit or active exploitation is known at time of analysis, but the high impact to confidentiality and integrity, combined with network reachability, makes this a high-priority risk.
Unauthenticated SQL injection in the Manacle Multi-Tenant ERP System's API endpoint allows remote attackers to inject arbitrary SQL through crafted input, giving high impact to both data confidentiality and integrity (CVSS 4.0 score 9.3; assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N). The affected CPE (cpe:2.3:a:manacle_technologies:multi-tenant_erp_system:*) carries no version constraint, indicating the flaw is described against the product as a whole rather than a bounded release range, and no fixed version is named in the advisory. There is no public exploit identified at time of analysis and no CISA KEV listing; no EPSS score was supplied in the source data, so likelihood of exploitation should be judged from exposure alone.
Unauthenticated authentication bypass in Manacle Technologies' Multi-Tenant ERP System lets a remote attacker forge payment-callback requests to mint a valid authenticated session as an arbitrary user, yielding full read and write access to that account and, given the multi-tenant design, potentially to data across tenant boundaries. Per the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) this is a genuine high-priority issue rather than an inflated score: exploitation requires no credentials and no user interaction, but it does depend on the payment-callback API being network-reachable and on the payment-integration feature being enabled and in use. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); the CPE data does not pin specific affected versions.
Source code disclosure in Manacle Technologies' Multi-Tenant ERP System allows unauthenticated remote attackers to reconstruct the application's source by downloading an exposed, web-accessible .git directory (CWE-527). Because the version-control metadata can be walked to recover full repository history, attackers can harvest hardcoded credentials, API keys, database schemas, and business logic that enable follow-on attacks. No public exploit or CISA KEV listing exists at this time, but .git exposure is trivially exploited with widely available off-the-shelf tooling.
Sensitive-data exposure in Manacle Technologies' Multi-Tenant ERP System allows an unauthenticated remote attacker to read other users' data by manipulating a parameter on a vulnerable API endpoint. The flaw stems from missing authorization checks (IDOR) on an endpoint reachable without credentials, and in a multi-tenant deployment it can enable cross-tenant data access. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported by CERT-In (CIVN-2026-0430).
Unauthenticated remote code execution in Manacle Technologies' Multi-Tenant ERP System allows attackers to upload arbitrary files to a web-accessible directory via an API endpoint that lacks both authentication and file-type validation. Any remote attacker can drop a server-side executable (e.g., a web shell) and run arbitrary code, fully compromising the host. Reported by CERT-In (CIVN-2026-0430) with a maximum CVSS 4.0 score of 10.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote code execution in Manacle Multi-Tenant ERP allows attackers to execute arbitrary code or manipulate application data through unsafe deserialization of user-controlled input (CWE-502). The vulnerability (CVE-2026-107104) is rated critical with a CVSS 4.0 score of 9.3 and requires no privileges or user interaction to exploit (PR:N/UI:N). No public exploit or active exploitation is known at time of analysis, but the high impact to confidentiality and integrity, combined with network reachability, makes this a high-priority risk.
Unauthenticated SQL injection in the Manacle Multi-Tenant ERP System's API endpoint allows remote attackers to inject arbitrary SQL through crafted input, giving high impact to both data confidentiality and integrity (CVSS 4.0 score 9.3; assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N). The affected CPE (cpe:2.3:a:manacle_technologies:multi-tenant_erp_system:*) carries no version constraint, indicating the flaw is described against the product as a whole rather than a bounded release range, and no fixed version is named in the advisory. There is no public exploit identified at time of analysis and no CISA KEV listing; no EPSS score was supplied in the source data, so likelihood of exploitation should be judged from exposure alone.
Unauthenticated authentication bypass in Manacle Technologies' Multi-Tenant ERP System lets a remote attacker forge payment-callback requests to mint a valid authenticated session as an arbitrary user, yielding full read and write access to that account and, given the multi-tenant design, potentially to data across tenant boundaries. Per the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) this is a genuine high-priority issue rather than an inflated score: exploitation requires no credentials and no user interaction, but it does depend on the payment-callback API being network-reachable and on the payment-integration feature being enabled and in use. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); the CPE data does not pin specific affected versions.
Source code disclosure in Manacle Technologies' Multi-Tenant ERP System allows unauthenticated remote attackers to reconstruct the application's source by downloading an exposed, web-accessible .git directory (CWE-527). Because the version-control metadata can be walked to recover full repository history, attackers can harvest hardcoded credentials, API keys, database schemas, and business logic that enable follow-on attacks. No public exploit or CISA KEV listing exists at this time, but .git exposure is trivially exploited with widely available off-the-shelf tooling.
Sensitive-data exposure in Manacle Technologies' Multi-Tenant ERP System allows an unauthenticated remote attacker to read other users' data by manipulating a parameter on a vulnerable API endpoint. The flaw stems from missing authorization checks (IDOR) on an endpoint reachable without credentials, and in a multi-tenant deployment it can enable cross-tenant data access. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported by CERT-In (CIVN-2026-0430).
Unauthenticated remote code execution in Manacle Technologies' Multi-Tenant ERP System allows attackers to upload arbitrary files to a web-accessible directory via an API endpoint that lacks both authentication and file-type validation. Any remote attacker can drop a server-side executable (e.g., a web shell) and run arbitrary code, fully compromising the host. Reported by CERT-In (CIVN-2026-0430) with a maximum CVSS 4.0 score of 10.0; no public exploit code or CISA KEV listing has been identified at time of analysis.