WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, the WebErpMesV2 application exposes multiple sensitive API endpoints without authentication middleware. An unauthenticated remote attacker can read business-critical data including companies, quotes, orders, tasks, and whiteboards. Limited write access allows creation of company records and full manipulation of collaboration whiteboards. This vulnerability is fixed in 1.19.
References
| Link | Resource |
|---|---|
| https://github.com/SMEWebify/WebErpMesv2/commit/3a7ab1c95d1d1c8f7c62c84bc87b3666ecd2fa23 | Patch |
| https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-pp68-5pc2-hv7w | Exploit Patch Vendor Advisory |
| https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-pp68-5pc2-hv7w | Exploit Patch Vendor Advisory |
Configurations
History
21 Jan 2026, 19:11
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/SMEWebify/WebErpMesv2/commit/3a7ab1c95d1d1c8f7c62c84bc87b3666ecd2fa23 - Patch | |
| References | () https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-pp68-5pc2-hv7w - Exploit, Patch, Vendor Advisory | |
| First Time |
Wem-project
Wem-project wem |
|
| CPE | cpe:2.3:a:wem-project:wem:*:*:*:*:*:*:*:* |
13 Jan 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-pp68-5pc2-hv7w - |
12 Jan 2026, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-12 22:16
Updated : 2026-01-21 19:11
NVD link : CVE-2026-22788
Mitre link : CVE-2026-22788
CVE.ORG link : CVE-2026-22788
JSON object : View
Products Affected
wem-project
- wem
CWE
CWE-306
Missing Authentication for Critical Function