EUVD-2026-102353

Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type and Location names in RuleForm.php and RuleInfolist.php. Attackers can store HTML/JavaScript payloads in names that execute when warehouse...

CVE-2026-110878

Aureus ERP versions through 1.6.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The vulnerability exists because Operation Type and Location names in RuleForm.php and RuleInfolist.php are not properly escaped. This allows authenticated users to inject malicious HTML or JavaScript pa...