Stored Cross-Site Scripting in Aureus ERP Chatter Field
CVE-2026-94387

5.1MEDIUM

Key Information:

Vendor

Aureuserp

Status
Aureuserp
Vendor
CVE Published:
21 September 2026

What is CVE-2026-94387?

Aureus ERP versions prior to 1.6.0 are susceptible to a stored cross-site scripting (XSS) vulnerability within the Chatter field-change log. Specifically, the 'old_value' and 'new_value' data entries are not properly sanitized, allowing users authorized to edit tracked text fields to inject malicious scripts. When other users access the Chatter panel, including administrators, these scripts can execute, posing a significant security risk to the application.

Affected Version(s)

aureuserp 0 < 1.6.0

aureuserp 1.6.0

References

https://github.com/aureuserp/aureuserp/commit/57cf5cf4c98...
patch
https://github.com/aureuserp/aureuserp/pull/1465
patchissue-tracking
https://github.com/aureuserp/aureuserp/blob/v1.5.0/plugin...
technical-description

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153
.