CVE-2026-110878

Received Received - Intake

Stored XSS in Aureus ERP via RuleForm and RuleInfolist

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type and Location names in RuleForm.php and RuleInfolist.php. Attackers can store HTML/JavaScript payloads in names that execute when warehouse managers or administrators view or edit Inventory Rules, performing actions in their session context.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-110878

EUVD

EUVD-2026-102353

Affected Vendors & Products

Vendor	Product	Version / Range
aureuserp	aureuserp	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Aureus ERP versions up to 1.6.0. Authenticated users can inject malicious scripts via unescaped Operation Type and Location names in RuleForm.php and RuleInfolist.php. The payloads execute when other users view or edit Inventory Rules, potentially performing actions in their session context.

Detection Guidance

Check for unescaped Operation Type and Location names in RuleForm.php and RuleInfolist.php files. Inspect database entries for malicious HTML/JavaScript payloads in these fields. Review server logs for unusual activity during rule viewing or editing.

Impact Analysis

An attacker could steal user sessions, perform unauthorized actions, or exfiltrate CSRF tokens. The payload persists in the database and triggers for every viewer of the affected Rule, affecting warehouse managers and administrators who interact with Inventory Rules.

Mitigation Strategies

Update to the latest version of Aureus ERP where the issue is fixed. Apply input validation and output escaping for Operation Type and Location names. Restrict permissions for creating/editing inventory rules to trusted users only.

Hi! I’m here to help you understand CVE-2026-110878. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70