Aureus ERP EUVD-2026-83915

Requires an authenticated Aureus ERP account (before v1.6.0) that is permitted to edit at least one tracked text field whose changes are recorded in the Chatter field-change log; the attacker stores markup in old_value/new_value via the vulnerable content-text-entry.blade.php rendering path. Exploitation is LIMITED by: (1) prior authentication and edit privilege on tracked fields (PR:L), and (2) required victim interaction (UI:P) - another user, ideally an administrator, must open the affected record's Chatter panel for the stored payload to execute. This is effectively a stored/privilege-escalation XSS scenario within a multi-user deployment, not an unauthenticated internet-facing attack.

This is a genuine but moderate-risk stored XSS confirmed at the source-code level: the patch diff shows Laravel Blade templates rendering $change['old_value']/$change['new_value'] via the unescaped {!! !!} directive (and unescaped concatenation in ChatterNotificationService), fixed by switching to escaped {{ }} output plus e(). The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N with subsequent SC:L/SI:L) is consistent with the description and I concur - this is not a high-severity issue. Key limiting signals: PR:L means the injector must be an authenticated user already permitted to edit tracked text fields, and UI:P means a victim must actually open the affected record's Chatter panel; impact is capped at VC:L/VI:L (session/UI-level script execution, no direct system compromise). No EPSS score, no CISA KEV listing, and no SSVC decision data were provided, so there is no evidence of active or automatable exploitation. A public technical write-up/POC exists (hackmd @leediay) and VulnCheck published an advisory, which raises the practical likelihood of opportunistic abuse but does NOT equal active exploitation. Net: prioritize as a normal patch (a fixed release exists), not an emergency - the real risk is a privilege-escalation-style attack where a lower-privileged internal user plants script that fires in an administrator's browser.

A low-privileged but authenticated Aureus ERP user edits a tracked text field (e.g., a record name or description) and enters malicious HTML/JavaScript as the new value. Because the Chatter field-change log renders old_value/new_value without escaping, the payload is stored and later executes in the browser of any user - including an administrator - who opens that record's Chatter panel, enabling session/action abuse in the victim's context. A public write-up describing the flaw exists (hackmd @leediay) alongside a VulnCheck advisory.