Vulnerability · Published Sep 17, 2026 · Assigned by VulnCheck
CVE-2026-93454Aureus ERP through 1.6.0 Stored XSS via Payment Term Note
Medium 5.4
In plain English
A medium-severity cross-site scripting in Aureus ERP from Webkul. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.3%top 77.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browsers of all users viewing that Payment Term record.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Webkul | Aureus ERP | 0 – through 1.6.0 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References
- https://github.com/aureuserp/aureuserp/pull/1562 patch, issue-tracking
- https://hackmd.io/@leediay/stored-xss-aureus-via-payment-term exploit
- https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/accounts/src/Filament/Resources/PaymentTermResource/Schemas/PaymentTermInfolist.php#L59 technical-description
- https://github.com/aureuserp/aureuserp product
- VulnCheck Advisory: Aureus ERP through 1.6.0 Stored XSS via Payment Term Note third-party-advisory