CVE-2026-22788

{"id": "CVE-2026-22788", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22788", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-13T14:14:45.621333Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "SMEWebify", "product": "WebErpMesv2", "versions": [{"status": "affected", "version": "< 1.19"}]}]}], "published": "2026-01-12T22:16:08.343", "references": [{"url": "https://github.com/SMEWebify/WebErpMesv2/commit/3a7ab1c95d1d1c8f7c62c84bc87b3666ecd2fa23", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-pp68-5pc2-hv7w", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-pp68-5pc2-hv7w", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, the WebErpMesV2 application exposes multiple sensitive API endpoints without authentication middleware. An unauthenticated remote attacker can read business-critical data including companies, quotes, orders, tasks, and whiteboards. Limited write access allows creation of company records and full manipulation of collaboration whiteboards. This vulnerability is fixed in 1.19."}, {"lang": "es", "value": "WebErpMesv2 es un sistema web de gesti\u00f3n de recursos y ejecuci\u00f3n de fabricaci\u00f3n para la industria. Antes de la 1.19, la aplicaci\u00f3n WebErpMesV2 expone m\u00faltiples puntos finales de API sensibles sin middleware de autenticaci\u00f3n. Un atacante remoto no autenticado puede leer datos cr\u00edticos para el negocio, incluyendo empresas, cotizaciones, pedidos, tareas y pizarras. Acceso de escritura limitado permite la creaci\u00f3n de registros de empresas y la manipulaci\u00f3n completa de pizarras de colaboraci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en la 1.19."}], "lastModified": "2026-06-17T10:20:25.760", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wem-project:wem:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8FFED4C-1ACD-4922-99EB-4951BD1C6B8E", "versionEndExcluding": "1.19"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}