CVE-2026-111284

Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads that execute when HR managers or administrators open the Holiday modal, hijacking their sessions.

CVSS 4.0

5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-25)

CWE

CWE-79

Published

2026-10-15

Modified

2026-10-16

Record from

the NVD, synced 2026-10-19

References

• https://github.com/aureuserp/aureuserp
• https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/time-off/src/Filament/Actions/HolidayAction.php#L42-L63
• https://github.com/aureuserp/aureuserp/pull/1606
• https://hackmd.io/@leediay/By7ESbAozl
• https://www.vulncheck.com/advisories/aureus-erp-through-1.6.0-stored-xss-via-time-off-holiday-action-modal

Check your stackJSON