CVE-2026-110878: Aureus ERP through 1.6.0 Stored XSS via Inventory Rule Action Information
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type and Location names in RuleForm.php and RuleInfolist.php. Attackers can store HTML/JavaScript payloads in names that execute when warehouse managers or administrators view or edit Inventory Rules, performing actions in their session context.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to the stored payload?
Warehouse managers or administrators who view or edit Inventory Rules containing attacker-controlled Operation Type or Location names can execute the stored script in their authenticated browser session.
What access does an attacker need to exploit this issue?
The attacker must be an authenticated user able to supply Operation Type or Location names that are later displayed in Inventory Rules. Victim interaction is also required: a warehouse manager or administrator must view or edit the affected rule.
How can I determine whether my deployment is affected?
Aureus ERP versions through 1.6.0 are affected. Review Inventory Rule views and edit forms for Operation Type and Location names rendered without escaping, particularly in RuleForm.php and RuleInfolist.php.