What’s Vulnerable › Vulnerabilities

CVE-2026-22788: WebErpMesv2 allows unauthenticated API Access

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-12 · updated 2026-06-17
• Weakness: CWE-306

Description

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, the WebErpMesV2 application exposes multiple sensitive API endpoints without authentication middleware. An unauthenticated remote attacker can read business-critical data including companies, quotes, orders, tasks, and whiteboards. Limited write access allows creation of company records and full manipulation of collaboration whiteboards. This vulnerability is fixed in 1.19.

Affected products

• Wem-Project Wem: before 1.19 — fixed in 1.19

How to fix

Upgrade to a fixed version: Wem-Project Wem 1.19. Check the vendor advisory for mitigations.

References

• https://github.com/SMEWebify/WebErpMesv2/commit/3a7ab1c95d1d1c8f7c62c84bc87b3666ecd2fa23
• https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-pp68-5pc2-hv7w
• https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-pp68-5pc2-hv7w

Get alerted when CVE-2026-22788 or the next vulnerability affects your stack