CVE-2026-94387

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-94387

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94387.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-94387

Published

2026-09-21T13:43:36Z

Modified

2026-09-23T03:47:29Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change Log

Details

Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where old_value and new_value entries are rendered without proper escaping. Any user permitted to edit tracked text fields can inject malicious markup that executes when other users, including administrators, view the record's Chatter panel.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94387.json"
}

References

Affected packages

Git / github.com/aureuserp/aureuserp

Affected ranges

Type

GIT

Repo

https://github.com/aureuserp/aureuserp

Events

Introduced

Fixed

b33fa04643a936885f83b5ad39a62260ef27a7a0

Fixed

57cf5cf4c98d82a0ad89003402f27823fbe1e27c

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.6.0"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v1.*

v1.0.0

v1.1.0

v1.2.0

v1.3.0

v1.3.0-BETA1

v1.3.0-BETA2

v1.3.0-BETA3

v1.3.1

v1.4.0

v1.5.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94387.json"