CVE-2026-110878

Deferred Deferred - Pending Action

Stored XSS in Aureus ERP via RuleForm and RuleInfolist

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type and Location names in RuleForm.php and RuleInfolist.php. Attackers can store HTML/JavaScript payloads in names that execute when warehouse managers or administrators view or edit Inventory Rules, performing actions in their session context.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110878

EUVD

EUVD-2026-102353

Affected Vendors & Products

Vendor	Product	Version / Range
aureuserp	aureuserp	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Aureus ERP versions up to 1.6.0. Authenticated users can inject malicious scripts via unescaped Operation Type and Location names in RuleForm.php and RuleInfolist.php. The payloads execute when other users view or edit Inventory Rules, potentially performing actions in their session context.

Detection Guidance

Check for unescaped Operation Type and Location names in RuleForm.php and RuleInfolist.php files. Inspect database entries for malicious HTML/JavaScript payloads in these fields. Review server logs for unusual activity during rule viewing or editing.

Impact Analysis

An attacker could steal user sessions, perform unauthorized actions, or exfiltrate CSRF tokens. The payload persists in the database and triggers for every viewer of the affected Rule, affecting warehouse managers and administrators who interact with Inventory Rules.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA due to the risk of unauthorized data access or modification. Stored XSS allows attackers to execute scripts in the context of authenticated users, which may lead to session hijacking, data theft, or unauthorized actions. GDPR requires protection against unauthorized data processing, while HIPAA mandates safeguards for sensitive health information. The lack of input sanitization in Operation Type and Location names could expose regulated data to unauthorized parties.

Mitigation Strategies

Update to the latest version of Aureus ERP where the issue is fixed. Apply input validation and output escaping for Operation Type and Location names. Restrict permissions for creating/editing inventory rules to trusted users only.

Hi! I’m here to help you understand CVE-2026-110878. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70