Vulnerability Description
Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browsers of all users viewing that Payment Term record.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/aureuserp/aureuserp
- https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/accounts/src/F
- https://github.com/aureuserp/aureuserp/pull/1562
- https://hackmd.io/@leediay/stored-xss-aureus-via-payment-term
- https://www.vulncheck.com/advisories/aureus-erp-through-1.6.0-stored-xss-via-pay
FAQ
What is CVE-2026-93454?
CVE-2026-93454 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrar...
How severe is CVE-2026-93454?
CVE-2026-93454 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-93454?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.