What’s Vulnerable › Vulnerabilities

CVE-2026-111284: Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-15 · updated 2026-10-16
• Weakness: CWE-79

Description

Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads that execute when HR managers or administrators open the Holiday modal, hijacking their sessions.

Affected products

• Webkul Aureus ERP: through 1.6.0

References

• https://github.com/aureuserp/aureuserp
• https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/time-off/src/Filament/Actions/HolidayAction.php#L42-L63
• https://github.com/aureuserp/aureuserp/pull/1606
• https://hackmd.io/@leediay/By7ESbAozl
• https://www.vulncheck.com/advisories/aureus-erp-through-1.6.0-stored-xss-via-time-off-holiday-action-modal

Get alerted when CVE-2026-111284 or the next vulnerability affects your stack