Aureus ERP through 1.6.0 Stored XSS via Payment Term Note

Advisories

Aureus ERP through 1.6.0 Stored XSS via Payment Term Note

Severity: medium
Date: 9/17/2026
Affecting: Aureus ERP <= 1.6.0
CVE: CVE-2026-93454
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS: 5.1
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
References: https://github.com/aureuserp/aureuserp/pull/1562
https://hackmd.io/@leediay/stored-xss-aureus-via-payment-term
https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/accounts/src/Filament/Resources/PaymentTermResource/Schemas/PaymentTermInfolist.php#L59
https://github.com/aureuserp/aureuserp
Credit: leediay153, Karan Parelkar, Devansh Sanghvi
Description: Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browsers of all users viewing that Payment Term record.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo