A manipulation of the composer.json file in Webkul Aureus ERP allows an attacker to insert sensitive data into debugging code. This flaw can expose confidential information to anyone who views the debug output, making it a classic information exposure vulnerability. The description explicitly notes that the attack may be launched remotely and that the exploit has been publicly disclosed, indicating that malicious actors already have the means to exploit the flaw. The weakness is classified under CWE‑200 and CWE‑215, confirming that it is a result of inadequate information disclosure controls. The impact is limited to confidentiality loss, with no stated integrity or availability compromise.

The vulnerability affects the Webkul Aureus ERP product, specifically all releases up to and including version 1.6.0. No other versions or versions beyond 1.6.0 are mentioned as affected. Other vendors or products are not listed, implying that the flaw is isolated to this particular web application.

The CVSS score of 6.9 places the flaw in the moderate severity range, suggesting that while the vulnerability is significant, it is not critical. Since the EPSS score is not available, no concrete exploitation probability can be derived; however, the fact that the exploit has been publicly disclosed and may be used increases the real‑world risk. The vulnerability is not listed in the CISA KEV catalog, so there is no known large‑scale exploit campaign yet documented. The likely attack vector is remote, as the description states, implying that an attacker can trigger the flaw by manipulating or uploading a crafted composer.json file or by influencing the application’s processing of that file. The exploitation path involves injecting sensitive data into debug output that is then visible to users or attackers in the system’s environment.