CVE-2026-110878
aureuserp: Aureus ERP through 1.6.0 Stored XSS via Inventory Rule Action Information
aureuserp aureuserp
CVSS
5.1MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 16 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 12% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type and Location names in RuleForm.php and RuleInfolist.php. Attackers can store HTML/JavaScript payloads in names that execute when warehouse managers or administrators view or edit Inventory Rules, performing actions in their session context.
Text from CVE List
Affected versions 1
- aureuserpaffected: all versions through 1.6.0CVE List
References 6
- github.com/aureuserp/aureuserp/pull/1619Fixvia CVE List
- vulncheck.com/advisories/aureus-erp-through-1.6.0-stored-xss-via-inventory-rule-action-informationAdvisoryvia CVE List
- hackmd.io/@leediay/Bk4Vpz0ifeExploitvia CVE List
- github.com/aureuserp/aureuserp/blob/b33fa04643a936885f83b5ad39a62260ef27a7a0/plugins/webkul/inventories/src/Filament/Clusters/Configurations/Resources/RuleResource/Schemas/RuleForm.php#L121-L153Referencevia CVE List
- github.com/aureuserp/aureuserp/blob/b33fa04643a936885f83b5ad39a62260ef27a7a0/plugins/webkul/inventories/src/Filament/Clusters/Configurations/Resources/RuleResource/Schemas/RuleInfolist.php#L24-L43Referencevia CVE List
- github.com/aureuserp/aureuserpReferencevia CVE List