5 results · Clear filters · Feed
-
Medium 5.3
Webkul Aureus ERP composer.json insertion of sensitive information into debugging code
A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some unknown processing of the file composer.json. Such manipulation leads to insertion of sensitive information into debugging code. The attack may be launched re…
-
Medium 5.4
Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory…
-
Medium 5.4
Aureus ERP 1.6.0 Stored XSS via SVG File Upload
Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with s…
-
Medium 5.4
Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change Log
Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where old_value and new_value entries are rendered without proper escaping. Any user permitted to edit tracked text fields can inject malicious markup…
-
Medium 5.4
Aureus ERP through 1.6.0 Stored XSS via Payment Term Note
Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists …