CVE-2026-110878
CVE-2026-110878 · Aureus ERP through 1.6.0 Stored XSS via Inventory Rule Action Information
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type and Location names in RuleForm.php and RuleInfolist.php. Attackers can store HTML/JavaScript payloads in names that execute when warehouse managers or administrators view or edit Inventory Rules, performing actions in their session context.
CVSS 5.1 · Media · EPSS 0,2%
- Publicación
- Actualización
Productos y versiones afectados
aureuserp
- Versiones
- ≥ 0, ≤ 1.6.0: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://hackmd.io/@leediay/Bk4Vpz0ife
- https://github.com/aureuserp/aureuserp/blob/b33fa04643a936885f83b5ad39a62260ef27a7a0/plugins/webkul/inventories/src/Filament/Clusters/Configurations/Resources/RuleResource/Schemas/RuleForm.php#L121-L153
- https://github.com/aureuserp/aureuserp/blob/b33fa04643a936885f83b5ad39a62260ef27a7a0/plugins/webkul/inventories/src/Filament/Clusters/Configurations/Resources/RuleResource/Schemas/RuleInfolist.php#L24-L43
- https://github.com/aureuserp/aureuserp/pull/1619
- https://github.com/aureuserp/aureuserp
- https://www.vulncheck.com/advisories/aureus-erp-through-1.6.0-stored-xss-via-inventory-rule-action-information
- https://nvd.nist.gov/vuln/detail/CVE-2026-110878