CVE-2026-93454: Aureus ERP through 1.6.0 Stored XSS via Payment Term Note
Published Sep 17, 2026
·Updated
Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browsers of all users viewing that Payment Term record.
Affected Software
1 affected component
Aureus ERP<=1.6.0
Event History
Sep 17, 2026
CVE Published
via MITRE·11:25 PM
Data Sourced
via MITRE·11:25 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue, and who is exposed to the payload?
An authenticated user with permission to create payment terms can submit the payload. It executes in the browsers of any users who view the affected Payment Term record in the Accounting plugin.
2
Is user interaction required for exploitation?
Yes. A user must view the Payment Term record containing the malicious note for the stored JavaScript to execute in that user's browser.
3
What versions are affected?
Aureus ERP through version 1.6.0 is affected.