CVE-2026-93454

Overview

Aureus ERP versions up to 1.6.0 allow authenticated users with payment‑term create permission to inject arbitrary JavaScript into the Payment Term note field. The unsanitized input is rendered as raw HTML in the Accounting plugin, causing cross‑site scripting (XSS) for all users who view the affected record. This flaw can lead to data theft, session hijacking, or malicious actions performed in the victim’s browser.

Description

Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browsers of all users viewing that Payment Term record.

Impact

The vulnerability exposes the confidentiality of sensitive financial data and allows attackers to tamper with the integrity of the Payment Term records. All authenticated users who have permission to create payment terms can inject code, and any user who views the record will execute it, potentially compromising session cookies or other browser data. Availability is not directly affected, but the attack surface is broadened for future exploitation.

Remediation

['Apply the official patch or upgrade to Aureus ERP 1.6.1 or later where the Payment Term note field is properly sanitized.', 'If a patch is unavailable, implement server‑side input validation to strip or encode HTML tags before storing the note.', 'Add a Content Security Policy (CSP) header that disallows inline scripts and restricts script sources to trusted origins.', 'Revoke or limit the payment‑term create permission to only trusted administrators until the issue is fixed.', 'Monitor application logs for unexpected POST requests to the payment‑terms endpoint and alert on suspicious payloads.']

Risk context

The CVSS v3 score of 5.4 classifies this as medium severity. With no EPSS data, the urgency is moderate; defenders should prioritize patching or mitigation to prevent potential data exfiltration or session hijacking.

Affected products

• Aureus ERP 1.6.0
• Aureus ERP 1.5.x
• Aureus ERP 1.4.x