CVE-2026-111284

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-111284

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111284.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-111284

Published

2026-10-15T21:43:27Z

Modified

2026-10-21T02:55:10Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal

Details

Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads that execute when HR managers or administrators open the Holiday modal, hijacking their sessions.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111284.json"
}

References

Affected packages

Git / github.com/aureuserp/aureuserp

Affected ranges

Type

GIT

Repo

https://github.com/aureuserp/aureuserp

Events

Introduced

Last Affected

b33fa04643a936885f83b5ad39a62260ef27a7a0

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "1.6.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "1.6.0"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

v1.*

v1.0.0

v1.1.0

v1.2.0

v1.3.0

v1.3.0-BETA1

v1.3.0-BETA2

v1.3.0-BETA3

v1.3.1

v1.4.0

v1.5.0

v1.6.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111284.json"