CVE-2026-94387
MediumCVSS 5.4Summary
Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where old_value and new_value entries are rendered without proper escaping. Any user permitted to edit tracked text fields can inject malicious markup that executes when other users, including administrators, view the record's Chatter panel.
Risk Assessment
Malicious markup injected by a user with edit rights can execute in other users' browsers, including administrators, potentially leading to session hijacking or unauthorized actions. The vulnerability requires permission to edit tracked text fields.
Recommendation
Upgrade Aureus ERP to version 1.6.0 or later. Until then, restrict edit rights on tracked text fields to trusted users.
Other vulnerabilities in Aureus ERP
See all- CVE-2026-95655High
Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes in the system.
- CVE-2026-93454Medium
Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browsers of all users viewing that Payment Term record.
Original NVD description (English source)
Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where old_value and new_value entries are rendered without proper escaping. Any user permitted to edit tracked text fields can inject malicious markup that executes when other users, including administrators, view the record's Chatter panel.