CVE-2026-94387: Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change Log

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-21 · updated 2026-09-28
Weakness: CWE-79

Description

Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where old_value and new_value entries are rendered without proper escaping. Any user permitted to edit tracked text fields can inject malicious markup that executes when other users, including administrators, view the record's Chatter panel.

Affected products

Webkul Aureus ERP: before 1.6.0 — fixed in 1.6.0

How to fix

Upgrade to a fixed version: Webkul Aureus ERP 1.6.0. Check the vendor advisory for mitigations.

References

https://github.com/aureuserp/aureuserp
https://github.com/aureuserp/aureuserp/blob/v1.5.0/plugins/webkul/chatter/resources/views/filament/infolists/components/messages/content-text-entry.blade.php#L165
https://github.com/aureuserp/aureuserp/blob/v1.5.0/plugins/webkul/chatter/resources/views/filament/infolists/components/messages/content-text-entry.blade.php#L182
https://github.com/aureuserp/aureuserp/commit/57cf5cf4c98d82a0ad89003402f27823fbe1e27c
https://github.com/aureuserp/aureuserp/pull/1465
https://github.com/aureuserp/aureuserp/releases/tag/v1.6.0
https://hackmd.io/@leediay/stored-xss-aureuserp-chatter
https://www.vulncheck.com/advisories/aureus-erp-before-1.6.0-stored-xss-via-chatter-field-change-log

Get alerted when CVE-2026-94387 or the next vulnerability affects your stack