CVE-2026-111284— Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal
Quick assessment
Affected
Webkul Aureus ERP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Aureus ERP 版本 1.6.0 及之前版本在 HolidayAction.php 文件中存在一个存储型跨站脚本（XSS）漏洞。该漏洞允许已认证用户通过未转义的假日名称（以 HtmlString 格式渲染）注入恶意脚本。拥有创建公共假日或强制假日权限的攻击者可以存储 JavaScript 恶意代码，当人力资源经理或管理员打开假日弹窗时，这些恶意脚本将自动执行，从而劫持其会话。
Possible ATT&CK Techniques 3 AI
T1059.001 · PowerShell T1098.004 · SSH Authorized Keys T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111284
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal
Source: CVE Program / CVE List V5
Vulnerability Description
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads that execute when HR managers or administrators open the Holiday modal, hijacking their sessions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Webkul | Aureus ERP | 0 ~ 1.6.0 | - |
|
II. Public POCs for CVE-2026-111284
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111284
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-111284 (1)
Vendor Advisories for CVE-2026-111284 (1)
Security Blog Posts for CVE-2026-111284 (1)
-
🔗 CVE-2026-111284 - Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal - HackMD Read full article technical-description exploit
Other References for CVE-2026-111284 (1)
IV. Related Vulnerabilities
Same product: Aureus ERP
-
CVE-2026-110218
Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure vi -
CVE-2026-97062
Aureus ERP 1.6.0 Stored XSS via SVG File Upload -
CVE-2026-95655
Aureus ERP before 1.5.0 Unscoped Message Access via ChatterP -
CVE-2026-94387
Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change -
CVE-2026-93454
Aureus ERP through 1.6.0 Stored XSS via Payment Term Note
Same vendor: Webkul
-
CVE-2026-110229
QloApps through 1.7.0 Missing Hotel Access Restriction in Cr -
CVE-2026-110226
QloApps through 1.7.0 Authorization Bypass via id_hotel in R -
CVE-2026-110224
QloApps through 1.7.0 Reflected XSS via Search Alias Validat -
CVE-2026-110221
QloApps through 1.7.0 Reflected XSS via Advanced Price Rule -
CVE-2026-110219
QloApps through 1.7.0 Reflected XSS via Additional Facility
Same weakness: CWE-79
-
CVE-2026-109193
HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scri -
CVE-2026-110252
WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored C -
CVE-2026-97640
WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scrip -
CVE-2026-107768
TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site -
CVE-2026-109388
HivePress <= 1.7.32 - Authenticated (Subscriber+) Stored Cro
V. Comments for CVE-2026-111284
No comments yet