CVE-2026-4175

Low

Description

A vulnerability was determined in Aureus ERP up to 1.3.0-BETA2. The affected element is an unknown function of the file plugins/webkul/chatter/resources/views/filament/infolists/components/messages/content-text-entry.blade.php of the component Chatter Message Handler. Executing a manipulation of the argument subject/body can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 1.3.0-BETA1 is sufficient to fix this issue. This patch is called 2135ee7efff4090e70050b63015ab5e268760ec8. It is suggested to upgrade the affected component.

SeverityLow

CVSS3.5

Exploit probability—

ProductAureuserp/aureuserp

PublishedMar 16, 2026

First seenMar 16, 2026

Weakness typeCWE-79Cross-site scripting (XSS)CWE-94Code injection

How to fix

Update

aureuserp/aureuserp1.3.0-BETA1 or later

Patches

Affected products

Product	Affected versions	Fixed in
aureuserp/aureuserpPackagist	v < 1.3.0-BETA1	1.3.0-BETA1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.