Aureus ERP EUVD-2026-102475

Requires an authenticated account that has been granted permission to create Public Holidays or Mandatory Days in the Webkul Time-Off plugin; the attacker stores a JavaScript payload in a holiday name, which HolidayAction.php renders unescaped via Illuminate\Support\HtmlString in the Holiday modal (source lines 42-63 of v1.6.0). Exploitation is LIMITED by two factors from the CVSS 4.0 vector: PR:L means a valid low-privilege authenticated account with holiday-creation rights is needed (not anonymous), and UI:P means the payload only fires when a privileged victim (HR manager or administrator) actually opens the Holiday modal - it does not self-trigger. It affects default rendering behavior of the Time-Off plugin in Aureus ERP builds through 1.6.0 and does not require any non-default configuration beyond the attacker holding the holiday-creation permission.

This is a genuine but moderate-priority issue, not a top-tier emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L) scores 5.1 (Medium), and the signals are internally consistent: it is network-reachable but requires an authenticated low-privilege account (PR:L) that is specifically permitted to create Public Holidays or Mandatory Days, plus passive user interaction (UI:P) from a privileged victim who opens the Holiday modal. A public proof-of-concept exists (hackmd writeup) and a vendor patch is available (PR #1606), so publicly available exploit code exists - but this is NOT confirmed active exploitation: the CVE is not listed in CISA KEV and no EPSS score was provided in the input, so widespread automated exploitation cannot be asserted. The practical impact is session hijacking of an HR manager or administrator, which is a privilege-escalation pathway (low-priv holiday creator to admin-context script execution), but it depends on both a malicious insider/compromised low-priv account AND a privileged victim viewing the crafted entry. Net: a real, patchable second-stage/insider-driven vulnerability worth remediating promptly in affected deployments, but lacking the mass-exploitation characteristics of a critical flaw. The only notable caveat: EPSS and KEV data are absent from the input, so real-world exploitation frequency is inferred as low-to-targeted rather than confirmed.

A low-privileged but authenticated Aureus ERP user who has been granted permission to create Public Holidays or Mandatory Days enters a holiday name containing a JavaScript payload, which is stored and later rendered unescaped as an HtmlString in the Time-Off plugin's Holiday modal. When an HR manager or administrator opens that modal, the script executes in their browser session, allowing session/cookie theft and actions in the privileged user's context. A public proof-of-concept for this exact flow is available.