CVE-2026-111284mediumCWE-79

CVE-2026-111284: medium-severity vulnerability in Webkul Aureus ERP

Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal

Published · Updated

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.1epss 0.2%
exploitation probability
0.2%top 88% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads that execute when HR managers or administrators open the Holiday modal, hijacking their sessions.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Affected products
Webkul · Aureus ERP
public PoCs found — 1
cve_referencehackmd.io/@leediay/By7ESbAozlunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Webkul Aureus ERP

In the same product, most dangerous first.

CVE-2026-95655HIGHAureus ERP before 1.5.0 Unscoped Message Access via ChatterPanelEPSS 0.5%CVE-2026-112193MEDIUMWebkul Aureus ERP UserForm.php weak passwordEPSS 0.5%CVE-2026-110218MEDIUMAureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URLEPSS 0.4%CVE-2026-94387MEDIUMAureus ERP before 1.6.0 Stored XSS via Chatter Field-Change LogEPSS 0.3%CVE-2026-112190MEDIUMWebkul Aureus ERP composer.json insertion of sensitive information into debugging codeEPSS 0.3%CVE-2026-93454MEDIUMAureus ERP through 1.6.0 Stored XSS via Payment Term NoteEPSS 0.3%
References
https://github.com/aureuserp/aureuserphttps://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/time-off/src/Filament/Actions/HolidayAction.php#L42-L63https://github.com/aureuserp/aureuserp/pull/1606https://hackmd.io/@leediay/By7ESbAozlhttps://www.vulncheck.com/advisories/aureus-erp-through-1.6.0-stored-xss-via-time-off-holiday-action-modal