Vulnerabilidades do Webkul Aureus ERP
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Webkul Aureus ERP: 3 registro(s), com versões afetadas e correções.
CVE-2026-111284
Média · 5.4
CWE-79 15/10/2026
Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads that execute when HR managers or administrators open the Holiday modal, hijacking their sessions.
CVE-2026-110218
Baixa · 3.7
CWE-862 13/10/2026
Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts via the customer-facing post view page. Attackers who know or guess a post slug can retrieve the full title, content, image, tags, author and publish date because PostResource skips authorization and ViewPost ignores is_published.
CVE-2026-97062
Média · 5.4
CWE-79 24/09/2026
Aureus ERP 1.6.0 Stored XSS via SVG File Upload
Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the file URL is opened directly, enabling session cookie theft and CSRF token exfiltration.