CVE-2026-111284
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php…
- Risk score
- 45/100
- CVSS
- 5.4 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 15 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads that execute when HR man…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 5.4 medium
- On your watchlist: php
References
- https://github.com/aureuserp/aureuserp
- https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/time-off/src/Filament/Actions/HolidayAction.php#L42-L63
- https://github.com/aureuserp/aureuserp/pull/1606
- https://hackmd.io/@leediay/By7ESbAozl
- https://www.vulncheck.com/advisories/aureus-erp-through-1.6.0-stored-xss-via-time-off-holiday-action-modal
Original description
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads that execute when HR managers or administrators open the Holiday modal, hijacking their sessions.
Last activity 15 Oct 2026. Patch Forecast updates every hour.