CVE-2026-94387

Aureus ERP before version 1.6.0 is affected by a stored cross-site scripting (XSS) vulnerability in the Chatter field-change log component. The root cause is that old_value and new_value entries are rendered without proper escaping in the Filament blade template. Any user permitted to edit tracke...

CVE-2026-94387 Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change Log

Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where oldvalue and newvalue entries are rendered without proper escaping. Any user permitted to edit tracked text fields can inject malicious markup that executes when other users, includi...

EUVD-2026-83915

Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where oldvalue and newvalue entries are rendered without proper escaping. Any user permitted to edit tracked text fields can inject malicious markup that executes when other users, includi...

CVE-2026-94387 Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change Log

Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where oldvalue and newvalue entries are rendered without proper escaping. Any user permitted to edit tracked text fields can inject malicious markup that executes when other users, includi...

CVE-2026-94387 Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change Log

Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where oldvalue and newvalue entries are rendered without proper escaping. Any user permitted to edit tracked text fields can inject malicious markup that executes when other users, includi...

CVE-2026-94387: Improper Neutralization of Input During Web Page Generation

Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where oldvalue and newvalue entries are rendered without proper escaping. Any user permitted to edit tracked text fields can inject malicious markup that executes when other users, includi...

PT-2026-96103

Name of the Vulnerable Software and Affected Versions Aureus ERP versions prior to 1.6.0 Description A stored cross-site scripting issue exists in the Chatter field-change log. The system fails to properly escape the old value and new value entries. This allows a user with permissions to edit...