Vulnerability · Published Aug 29, 2025 · Assigned by VulDB

CVE-2025-9619E4 Sistemas Mercatus ERP id resource injection

Medium 5.3

In plain English

A medium-severity security flaw in Mercatus ERP from E4 Sistemas. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 66.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in E4 Sistemas Mercatus ERP 2.00.019. The affected element is an unknown function of the file /basico/webservice/imprimir-danfe/id/. Performing manipulation results in improper control of resource identifiers. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
E4 Sistemas	Mercatus ERP	2.00.019

Weakness: CWE-99 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:X/RC:C

References

VDB-321790 | E4 Sistemas Mercatus ERP id resource injection vdb-entry
VDB-321790 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #636623 | e4sistemas Mercatus ERP v 2.00.019 Insecure Direct Object Reference (IDOR) third-party-advisory