Medium severity · published Sep 21, 2026
CVE-2026-94387
Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change Log
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where old_value and new_value entries are rendered without proper escaping. Any user permitted to edit tracked text fields can inject malicious markup that executes when other users, including administrators, view the record's Chatter panel.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AE
Aureus ERP · Webkul
before 1.6.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-94387
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-94387
patch
https://github.com/aureuserp/aureuserp/commit/57cf5cf4c98d82a0ad89003402f27823fbe1e27c
patch
https://github.com/aureuserp/aureuserp/pull/1465
technical-description
https://github.com/aureuserp/aureuserp/blob/v1.5.0/plugins/webkul/chatter/resources/views/filament/infolists/components/messages/content-text-entry.blade.php#L165
technical-description
https://github.com/aureuserp/aureuserp/blob/v1.5.0/plugins/webkul/chatter/resources/views/filament/infolists/components/messages/content-text-entry.blade.php#L182
third-party-advisory
https://hackmd.io/@leediay/stored-xss-aureuserp-chatter
release-notes
https://github.com/aureuserp/aureuserp/releases/tag/v1.6.0
More from Aureus ERP
8.1
CVE-2026-95655
Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanel
5.4
CVE-2026-111284
Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal
5.4
CVE-2026-97062
Aureus ERP 1.6.0 Stored XSS via SVG File Upload
5.4
CVE-2026-93454
Aureus ERP through 1.6.0 Stored XSS via Payment Term Note
5.3
CVE-2026-112190
Webkul Aureus ERP composer.json insertion of sensitive information into debugging code