Webkul Aureus Erp
8 CVEs affecting Webkul Aureus Erp. Latest disclosed: 2026-10-19. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-95655 | High | 8.1 | 2026-09-22 | Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attack… |
CVE-2026-111284 | Medium | 5.4 | 2026-10-15 | Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unesca… |
CVE-2026-97062 | Medium | 5.4 | 2026-09-24 | Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authentic… |
CVE-2026-94387 | Medium | 5.4 | 2026-09-21 | Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where old_value and new_value entries are rendered… |
CVE-2026-93454 | Medium | 5.4 | 2026-09-18 | Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-t… |
CVE-2026-112190 | Medium | 5.3 | 2026-10-19 | A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some unknown processing of the file composer.json. Such manipul… |
CVE-2026-112193 | Low | 3.7 | 2026-10-19 | A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacted is an unknown function of the file plugins/webkul/security/src/Filament/Resources/UserR… |
CVE-2026-110218 | Low | 3.7 | 2026-10-13 | Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts via the cust… |