Aureus ERP EUVD-2026-102353

Exploitation requires an authenticated account with permission to create or edit inventory Operation Types and Location names (the fields rendered unescaped in RuleForm.php and RuleInfolist.php). The stored payload only executes when a privileged user (warehouse manager or administrator) subsequently views or edits the affected Inventory Rule, so victim interaction is mandatory (CVSS UI:P) and the attack cannot fire autonomously. Limiting factors: attacker must already be authenticated (PR:L, so no anonymous exploitation), the target feature is the Inventory module's Rule configuration (not reachable without inventory-configuration access), and impact is confined to actions available in the victim's session. Affected versions: Aureus ERP through 1.6.0; the fix is available upstream.

This is a genuine but modest-priority issue, not a high-CVSS-but-low-real-risk mismatch - the signals are internally consistent. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N, score 5.1 MEDIUM) describes a network-reachable but privilege-and-interaction-gated stored XSS: the attacker must already hold a low-privileged authenticated account (PR:L), and exploitation only triggers when a victim (warehouse manager or administrator) passively views or edits the affected Inventory Rule (UI:P). Impact is limited to Low confidentiality/integrity on both the vulnerable and a subsequent system (the victim's authenticated browser session), with no availability impact - matching a scripted-action XSS rather than a full account takeover primitive. A public POC exists (hackmd write-up) and a vendor patch is merged (PR #1619), which raises practical exploitability, but there is NO EPSS score provided and the CVE is NOT on the CISA KEV list, so there is no evidence of active or widespread exploitation. The realistic risk is targeted insider or low-privilege-user abuse against higher-privileged operators within a single ERP tenant, not mass automated exploitation. No signals conflict; the main caveat is that EPSS data is simply absent from the input, so quantitative exploitation probability cannot be stated.

A low-privileged authenticated user with access to inventory configuration stores a malicious HTML/JavaScript payload inside an Operation Type or Location name. When a warehouse manager or administrator later views or edits the corresponding Inventory Rule, the unescaped name is rendered and the script executes in their authenticated session, letting the attacker perform actions as that higher-privileged user. A public proof-of-concept write-up is available, and the payload-delivery step requires only normal form input.