Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110878— Aureus ERP through 1.6.0 Stored XSS via Inventory Rule Action Information

Quick assessment

Affected
aureuserp aureuserp
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Aureus ERP 1.6.0 及之前版本中存在一个存储型跨站脚本（XSS）漏洞。该漏洞允许经过身份验证的用户通过在 RuleForm.php 和 RuleInfolist.php 中未转义的操作类型（Operation Type）和位置（Location）名称注入恶意脚本。攻击者可以将 HTML/JavaScript 载荷存储在这些名称字段中，当仓库管理员或管理员查看或编辑库存规则时，这些脚本将自动执行，并在受害者的会话上下文中执行任意操作。

CVSS 5.4 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
aureuserp aureuserp ≤ 1.6.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110878

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Aureus ERP through 1.6.0 Stored XSS via Inventory Rule Action Information
Source: CVE Program / CVE List V5
Vulnerability Description
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type and Location names in RuleForm.php and RuleInfolist.php. Attackers can store HTML/JavaScript payloads in names that execute when warehouse managers or administrators view or edit Inventory Rules, performing actions in their session context.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
aureuserp aureuserp 0 ~ 1.6.0 -

II. Public POCs for CVE-2026-110878

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110878

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-110878 (2)

Vendor Advisories for CVE-2026-110878 (1)

Security Blog Posts for CVE-2026-110878 (1)

Other References for CVE-2026-110878 (1)

IV. Related Vulnerabilities

Same weakness: CWE-79

V. Comments for CVE-2026-110878

No comments yet

Leave a comment