CVE-2026-93454

Medium

Description

Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browsers of all users viewing that Payment Term record.

SeverityMedium

CVSS5.4

Exploit probability—

ProductAureus ERP

PublishedSep 18, 2026

First seenSep 18, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Patches

github.com/aureuserp/aureuserp/pull/1562

Affected products

Product	Affected versions	Fixed in
Webkul Aureus ERP	v ≤ 1.6.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.