Vulnerability intelligence

CVE-2026-107104 is an unsafe deserialization vulnerability (CWE-502) affecting the Multi-tenant Enterprise Resource Planning (ERP) system developed by Manacle Technologies. The issue arises because the platform, which is designed to manage core business processes for multiple organizations in a shared environment, performs unsafe deserialization of user-controlled data within its affected functionality. An unauthenticated remote attacker can exploit this vulnerability by supplying specially crafted data to the vulnerable functionality of the targeted system. Successful exploitation can allow the attacker to execute arbitrary code, manipulate application data, or perform other unauthorized actions on the host system.

CVE-2026-107103 is an SQL injection vulnerability affecting the Multi-tenant Enterprise Resource Planning (ERP) system developed by Manacle Technologies. The flaw is caused by insufficient validation and parameterization of user-supplied input within an API endpoint of the ERP application. Because the system fails to properly sanitize this input, an unauthenticated remote attacker can exploit the vulnerability by sending specially crafted requests to the exposed endpoint. If successfully exploited, the vulnerability allows attackers to execute arbitrary SQL commands on the backend database. This can enable unauthorized actors to access sensitive database records, manipulate application data, or perform other unintended actions on the targeted system.

CVE-2026-107102 is an account takeover vulnerability identified in the multi-tenant Enterprise Resource Planning (ERP) system developed by Manacle Technologies. Reported by the Indian Computer Emergency Response Team (CERT-In), the flaw is rooted in the insufficient verification of data authenticity (CWE-345). The issue arises due to improper validation of payment callback parameters combined with inadequate authentication controls within the application's API endpoint. To exploit this vulnerability, an unauthenticated remote attacker can manipulate the payment callback parameters. This manipulation causes the application to establish an authenticated session for an arbitrary user without requiring valid payment verification. As a result, attackers can bypass standard authentication protocols and gain unauthorized access to other user accounts on the targeted system.

Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts.

Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.