Medium 4.3Published Aug 29, 2025

CVE-2025-58156Centurion ERP is an ERP with a focus on ITSM and automation.

Updated under an hour ago (2026-10-19 09:10 UTC)

Does this affect you?

It affects nofusscomputing centurion_erp. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for nofusscomputing centurion_erp

Exploited in the last 30 days

Centurion ERP is an ERP with a focus on ITSM and automation. In versions starting from 1.12.0 to before 1.21.0, an authenticated user can view all authentication token details within the database. This includes the actual token, although only the hashed token. This does not include any un-hashed authentication token as viewable. This issue has been patched in version 1.21.0. A workaround for this is not deemed viable as it would involve disabling token authentication. Users are encouraged to remove any authentication token that was created by one of the effected versions of Centurion ERP. Webmasters can ensure this occurs by removing all authentication tokens from the database.

CVSS: 4.3 MEDIUM (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness (CWE): CWE-285
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Analyzed
Record last updated: Oct 18, 2026
First seen by InfoSec Signals: Oct 18, 2026

Affected products

Affected products

nofusscomputing centurion_erp nofusscomputing:centurion_erp	from 1.12.0 before 1.21.0	NVD

References

https://github.com/nofusscomputing/centurion_erp/commit/332eb1075ad828e5c4c24caeaf5605259eb7ce34patch
https://github.com/nofusscomputing/centurion_erp/pull/974issue-tracking
https://github.com/nofusscomputing/centurion_erp/security/advisories/GHSA-x75j-cm35-5qcgvendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.