CVE-2026-110878
Aureus ERP through 1.6.0 Stored XSS via Inventory Rule Action Information
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type and Location names in RuleForm.php and RuleInfolist.php. Attackers can store HTML/JavaScript payloads in names that execute when warehouse managers or administrators view or edit Inventory Rules, performing actions in their session context.
| CWE | CWE-79 |
| Vendor | aureuserp |
| Product | aureuserp |
| Published | Oct 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for aureuserp aureuserp
Be the first to know when new medium vulnerabilities affecting aureuserp aureuserp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
aureuserp / aureuserp
0 ≤ 1.6.0
References
hackmd.io: https://hackmd.io/@leediay/Bk4Vpz0ife github.com: https://github.com/aureuserp/aureuserp/blob/b33fa04643a936885f83b5ad39a62260ef27a7a0/plugins/webkul/inventories/src/Filament/Clusters/Configurations/Resources/RuleResource/Schemas/RuleForm.php#L121-L153 github.com: https://github.com/aureuserp/aureuserp/blob/b33fa04643a936885f83b5ad39a62260ef27a7a0/plugins/webkul/inventories/src/Filament/Clusters/Configurations/Resources/RuleResource/Schemas/RuleInfolist.php#L24-L43 github.com: https://github.com/aureuserp/aureuserp/pull/1619 github.com: https://github.com/aureuserp/aureuserp vulncheck.com: https://www.vulncheck.com/advisories/aureus-erp-through-1.6.0-stored-xss-via-inventory-rule-action-information
Credits
leediay153 from Viettel Post