CVE-2026-111284

Deferred Deferred - Pending Action

Stored XSS in Aureus ERP via HolidayAction.php

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads that execute when HR managers or administrators open the Holiday modal, hijacking their sessions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111284

Affected Vendors & Products

Vendor	Product	Version / Range
Webkul	Aureus	ERP 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Aureus ERP through version 1.6.0 has a stored cross-site scripting (XSS) vulnerability in HolidayAction.php. Authenticated users with permission to create Public Holidays or Mandatory Days can inject malicious JavaScript code via unescaped holiday names. This payload executes when HR managers or administrators open the Holiday modal, potentially allowing session hijacking.

Detection Guidance

Check for stored JavaScript payloads in holiday names within Aureus ERP's Public Holidays or Mandatory Days sections. Inspect HolidayAction.php for unescaped inputs rendered as HtmlString.

Impact Analysis

If exploited, this vulnerability could allow attackers to steal session cookies or sensitive data from HR managers and administrators. It may lead to unauthorized account access, data breaches, or further compromise of the ERP system. Users with appropriate permissions could unknowingly execute malicious scripts.

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized access to personal data or HIPAA by exposing protected health information. It may lead to non-compliance with data protection requirements, resulting in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Aureus ERP to a version beyond 1.6.0. Apply input validation and output encoding for holiday names. Restrict user permissions to prevent unauthorized holiday creation.

Hi! I’m here to help you understand CVE-2026-111284. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70