Multi Tenant Erp System
Monthly
Source code disclosure in Manacle Technologies' Multi-Tenant ERP System allows unauthenticated remote attackers to reconstruct the application's source by downloading an exposed, web-accessible .git directory (CWE-527). Because the version-control metadata can be walked to recover full repository history, attackers can harvest hardcoded credentials, API keys, database schemas, and business logic that enable follow-on attacks. No public exploit or CISA KEV listing exists at this time, but .git exposure is trivially exploited with widely available off-the-shelf tooling.
Sensitive-data exposure in Manacle Technologies' Multi-Tenant ERP System allows an unauthenticated remote attacker to read other users' data by manipulating a parameter on a vulnerable API endpoint. The flaw stems from missing authorization checks (IDOR) on an endpoint reachable without credentials, and in a multi-tenant deployment it can enable cross-tenant data access. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported by CERT-In (CIVN-2026-0430).
Unauthenticated remote code execution in Manacle Technologies' Multi-Tenant ERP System allows attackers to upload arbitrary files to a web-accessible directory via an API endpoint that lacks both authentication and file-type validation. Any remote attacker can drop a server-side executable (e.g., a web shell) and run arbitrary code, fully compromising the host. Reported by CERT-In (CIVN-2026-0430) with a maximum CVSS 4.0 score of 10.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Source code disclosure in Manacle Technologies' Multi-Tenant ERP System allows unauthenticated remote attackers to reconstruct the application's source by downloading an exposed, web-accessible .git directory (CWE-527). Because the version-control metadata can be walked to recover full repository history, attackers can harvest hardcoded credentials, API keys, database schemas, and business logic that enable follow-on attacks. No public exploit or CISA KEV listing exists at this time, but .git exposure is trivially exploited with widely available off-the-shelf tooling.
Sensitive-data exposure in Manacle Technologies' Multi-Tenant ERP System allows an unauthenticated remote attacker to read other users' data by manipulating a parameter on a vulnerable API endpoint. The flaw stems from missing authorization checks (IDOR) on an endpoint reachable without credentials, and in a multi-tenant deployment it can enable cross-tenant data access. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported by CERT-In (CIVN-2026-0430).
Unauthenticated remote code execution in Manacle Technologies' Multi-Tenant ERP System allows attackers to upload arbitrary files to a web-accessible directory via an API endpoint that lacks both authentication and file-type validation. Any remote attacker can drop a server-side executable (e.g., a web shell) and run arbitrary code, fully compromising the host. Reported by CERT-In (CIVN-2026-0430) with a maximum CVSS 4.0 score of 10.0; no public exploit code or CISA KEV listing has been identified at time of analysis.