CVE-2026-111284CWE-79cross-site-scripting

CVE-2026-111284

Medium · published October 16, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
11.3
In the wild
Unconfirmed
What it is

Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads that execute when HR managers or administrators open the Holiday modal, hijacking their sessions.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00215 · 11.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-10-16T02:19Z
References (5)
https://github.com/aureuserp/aureuserp · [email protected]https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/time-off/src/Filament/Actions/HolidayAction.php#L42-L63 · [email protected]https://github.com/aureuserp/aureuserp/pull/1606 · [email protected]https://hackmd.io/@leediay/By7ESbAozl · [email protected]https://www.vulncheck.com/advisories/aureus-erp-through-1.6.0-stored-xss-via-time-off-holiday-action-modal · [email protected]
EPSS history
Timeline
  • 17 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 15 OCT 21:43Z
    Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal
    cvelistv5
  • 15 OCT 21:43Z
    Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal
    cvelistv5