Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2026-111284

Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal

Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads that execute when HR managers or administrators open the Holiday modal, hijacking their sessions.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Aureus Erp
CVE-2026-112193

Webkul Aureus ERP UserForm.php weak password

A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacted is an unknown function of the file plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php. Performing a manipulation of the argument Password results in weak password requirements. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Aureus Erp
CVE-2026-112190

Webkul Aureus ERP composer.json insertion of sensitive information into debugging code

A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some unknown processing of the file composer.json. Such manipulation leads to insertion of sensitive information into debugging code. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Aureus Erp
CVE-2026-110218

Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL

Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts via the customer-facing post view page. Attackers who know or guess a post slug can retrieve the full title, content, image, tags, author and publish date because PostResource skips authorization and ViewPost ignores is_published.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Aureus Erp
CVE-2026-97062

Aureus ERP 1.6.0 Stored XSS via SVG File Upload

Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the file URL is opened directly, enabling session cookie theft and CSRF token exfiltration.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Aureus Erp
CVE-2026-93454

Aureus ERP through 1.6.0 Stored XSS via Payment Term Note

Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browsers of all users viewing that Payment Term record.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Aureus Erp