Skip to content
OpenAdvisories

Vendor

aureuserp

2 known vulnerabilities.

Products

aureuserp 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-111632

    Aureus ERP through 1.6.0 Multi-Company Authorization Bypass via company_id

    Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a foreign company_id. Attackers can submit create or update requests to plugin REST AP…

    aureuserp aureuserp
  • Medium 5.4
    CVE-2026-110878

    Aureus ERP through 1.6.0 Stored XSS via Inventory Rule Action Information

    Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type and Location names in RuleForm.php and RuleInfolist.php. Attackers can store HTML/JavaScript payloads …

    aureuserp aureuserp