CVE-2026-93454 - Aureus ERP through 1.6.0 Stored XSS via Payment Term Note
Brief
CVE ID : CVE-2026-93454
Published : Sept. 18, 2026, 12:17 a. m.
- 38 minutes ago
Description : Aureus ERP through 1.
- 0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browsers of all users viewing that Payment Term record.
Severity: 5.4
- MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...