Medium severity · published Oct 15, 2026
CVE-2026-111284
Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads that execute when HR managers or administrators open the Holiday modal, hijacking their sessions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AE
Aureus ERP · Webkul
through 1.6.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111284
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111284
github.com
https://github.com/aureuserp/aureuserp
github.com
https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/time-off/src/Filament/Actions/HolidayAction.php#L42-L63
github.com
https://github.com/aureuserp/aureuserp/pull/1606
hackmd.io
https://hackmd.io/@leediay/By7ESbAozl
www.vulncheck.com
https://www.vulncheck.com/advisories/aureus-erp-through-1.6.0-stored-xss-via-time-off-holiday-action-modal
More from Aureus ERP
8.1
CVE-2026-95655
Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanel
5.4
CVE-2026-97062
Aureus ERP 1.6.0 Stored XSS via SVG File Upload
5.4
CVE-2026-94387
Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change Log
5.4
CVE-2026-93454
Aureus ERP through 1.6.0 Stored XSS via Payment Term Note
5.3
CVE-2026-112190
Webkul Aureus ERP composer.json insertion of sensitive information into debugging code