CVE-2026-94387: Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change Log
Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where oldvalue and newvalue entries are rendered without proper escaping. Any user permitted to edit tracked text fields can inject malicious markup that executes when other users, including administrators, view the record's Chatter panel.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk from the payload?
Any authenticated user who is allowed to edit tracked text fields can inject malicious markup into a field-change log entry. The payload executes when another user views the affected record's Chatter panel, including administrators.
What versions are affected?
Aureus ERP versions before 1.6.0 are affected. The issue is in the Chatter field-change log rendering of old_value and new_value entries.
Does exploitation require user interaction?
Yes. An attacker must be permitted to edit a tracked text field, and a victim must view the affected record's Chatter panel. The vulnerable application is reachable over the network.