CVE-2026-4175

LOW

Aureus ERP <= 1.3.0-BETA2 - Cross-Site Scripting in Chatter Message Handler

Title source: llm
STIX 2.1

Description

A vulnerability was determined in Aureus ERP up to 1.3.0-BETA2. The affected element is an unknown function of the file plugins/webkul/chatter/resources/views/filament/infolists/components/messages/content-text-entry.blade.php of the component Chatter Message Handler. Executing a manipulation of the argument subject/body can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 1.3.0-BETA1 is sufficient to fix this issue. This patch is called 2135ee7efff4090e70050b63015ab5e268760ec8. It is suggested to upgrade the affected component.

References (6)

Core 6
Core References
Permissions Required, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.351083
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.351083
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.769827
Issue Tracking issue-tracking patch
https://github.com/aureuserp/aureuserp/pull/939

Scores

CVSS v3 3.5
EPSS 0.0025
EPSS Percentile 16.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79 CWE-94
Status published
Products (3)
Aureus/ERP 1.3.0-BETA1
Aureus/ERP 1.3.0-BETA2
aureuserp/aureuserp 0 - 1.3.0-BETA1Packagist
Published Mar 16, 2026
Tracked Since Mar 16, 2026