CVE-2026-93454CWE-79cross-site-scripting

CVE-2026-93454

Medium · published September 18, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
21.4
In the wild
Unconfirmed
What it is

Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browsers of all users viewing that Payment Term record.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00298 · 21.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-18T04:17Z
References (5)
https://github.com/aureuserp/aureuserp · [email protected]https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/accounts/src/Filament/Resources/PaymentTermResource/Schemas/PaymentTermInfolist.php#L59 · [email protected]https://github.com/aureuserp/aureuserp/pull/1562 · [email protected]https://hackmd.io/@leediay/stored-xss-aureus-via-payment-term · [email protected]https://www.vulncheck.com/advisories/aureus-erp-through-1.6.0-stored-xss-via-payment-term-note · [email protected]
EPSS history
Timeline
  • 17 SEP 23:25Z
    Aureus ERP through 1.6.0 Stored XSS via Payment Term Note
    cvelistv5