CVE-2026-111284

MEDIUM 5.4

Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads that execute when HR managers or administrators open the Holiday modal, hijacking their sessions.

CWE	CWE-79
Vendor	webkul
Product	aureus erp
Published	Oct 15, 2026

Stay Ahead of the Next One

Get instant alerts for webkul aureus erp

Be the first to know when new medium vulnerabilities affecting webkul aureus erp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

Webkul / Aureus ERP

0 ≤ 1.6.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@leediay/By7ESbAozl github.com: https://github.com/aureuserp/aureuserp/pull/1606 github.com: https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/time-off/src/Filament/Actions/HolidayAction.php#L42-L63 github.com: https://github.com/aureuserp/aureuserp vulncheck.com: https://www.vulncheck.com/advisories/aureus-erp-through-1.6.0-stored-xss-via-time-off-holiday-action-modal

Credits

leediay153 from Viettel Post