CVE-2026-94387
Received Received - Intake

Stored XSS in Aureus ERP Chatter Field-Change Log

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: VulnCheck

Description
Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where old_value and new_value entries are rendered without proper escaping. Any user permitted to edit tracked text fields can inject malicious markup that executes when other users, including administrators, view the record's Chatter panel.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-94387
EUVD
EUVD-2026-83915

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
aureus erp to 1.6.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-94387 is a stored cross-site scripting (XSS) vulnerability in Aureus ERP versions before 1.6.0. It occurs in the Chatter field-change log where old_value and new_value entries are rendered without proper escaping. Any user with permission to edit tracked text fields can inject malicious scripts that execute when others view the Chatter panel.

Detection Guidance

To detect this vulnerability, inspect Aureus ERP instances running versions before 1.6.0. Check the Chatter field-change log for unescaped HTML in old_value and new_value entries. Look for suspicious payloads like <img src=x onerror=...> in task titles, project names, or invoice references. Use browser developer tools to examine rendered HTML output for improper escaping.

Impact Analysis

This vulnerability allows attackers to inject malicious scripts into the Chatter field-change log. When users view these changes, the scripts execute in their browsers, potentially leading to session hijacking, theft of cookies or CSRF tokens, and full account takeover of high-privilege accounts like administrators.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling session hijacking, theft of cookies or CSRF tokens, and full account takeover of high-privilege accounts. Such unauthorized access could lead to unauthorized data exposure or modification, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Immediately upgrade Aureus ERP to version 1.6.0 or later. If upgrading is not possible, apply the security patch from PR #1465 which escapes HTML entities in chatter change summaries. Review all tracked text fields for injected scripts and remove any malicious content. Monitor Chatter logs for unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94387. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart