What is CVE-2026-4175?

CVE-2026-4175 is a low-severity vulnerability in Aureus Erp, classified under Cross-site Scripting. CVSS score: 3.5/10. Published 2026-03-15.

How severe is CVE-2026-4175?

Low severity. CVSS v3 base score is 3.5 out of 10.

RCE in Aureus Erp

CVE-2026-4175

A vulnerability was determined in Aureus ERP up to 1.3.0-BETA2. The affected element is an unknown function of the file plugins/webkul/chatter/resources/views/filament/infolists/components/messages/content-text-entry.blade.php of the compo…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.000 (3.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C.

Affected products

Aureus Erp — versions 1.3.0-BETA2, 1.3.0-BETA1

Weakness classification (CWE)

References

VDB-351083 | Aureus ERP Chatter Message content-text-entry.blade.php cross site scripting (vdb-entry, technical-description)
VDB-351083 | CTI Indicators (IOB, IOC, TTP, IOA) (signature, permissions-required)
Submit #769827 | aureuserp 51b975a Cross Site Scripting (third-party-advisory)
github.com/aureuserp/aureuserp/pull/939 (issue-tracking, patch)
github.com/aureuserp/aureuserp/commit/2135ee7efff4090e70050b63015ab5e268760ec8 (patch)
github.com/aureuserp/aureuserp/releases/tag/v1.3.0-BETA1 (patch)

Frequently asked questions

What is CVE-2026-4175?: CVE-2026-4175 is a low-severity vulnerability in Aureus Erp, classified under Cross-site Scripting. CVSS score: 3.5/10. Published 2026-03-15.
How severe is CVE-2026-4175?: Low severity. CVSS v3 base score is 3.5 out of 10.