Aureus Erp
Monthly
Webkul Aureus ERP through 1.6.0 fails to enforce sufficient password-strength requirements in the user creation/edit form implemented in UserForm.php, allowing accounts to be configured with weak passwords. Remote attackers without prior authentication (PR:N) can exploit this weakness through online password guessing or brute-force attempts, although exploitation is considered difficult (CVSS AC:H) and the direct impact is limited to low confidentiality. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV), and the CVSS 4.0 score is 2.9.
Sensitive information exposure in Webkul Aureus ERP through 1.6.0 allows unauthenticated remote attackers to retrieve debugging-related data reachable via composer.json, and publicly available exploit code exists. The CVSS 4.0 vector shows network reachability with no privileges or user interaction and only low confidentiality impact; integrity and availability are unaffected, and there is no CISA KEV confirmation. Real-world risk is limited to deployments that expose composer.json or associated debug/metadata output, with the product's narrow footprint further reducing exposure.
Stored cross-site scripting in Webkul's Aureus ERP through version 1.6.0 allows an authenticated user holding permission to create Public Holidays or Mandatory Days to store JavaScript in a holiday name, which is then rendered unescaped as an HtmlString inside the Time-Off plugin's Holiday modal. The payload executes in the browser of any HR manager or administrator who opens that modal, enabling session hijacking or privileged actions in the victim's context. Publicly available exploit code exists, but the issue is moderate-priority rather than an emergency: the CVSS 4.0 vector (PR:L/UI:P) requires a valid low-privilege account with holiday-creation rights, and the script only fires when a privileged user actually opens the affected modal rather than self-triggering.
Stored cross-site scripting in Aureus ERP through 1.6.0 allows an authenticated user to upload an SVG file containing embedded JavaScript that is written to the application's public disk and served from the application origin, so the script executes in a victim's browser session when the uploaded file's direct URL is opened. Successful exploitation enables theft of session cookies and CSRF tokens, giving the attacker the ability to act as the victim within the ERP; independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (vendor score 5.1), reflecting a cross-site scripted response that requires a second user to open the crafted file URL. Exploitation prerequisites are non-trivial - the attacker must hold an authenticated account with access to a file-upload field and the victim must navigate to the stored file - and no public exploit identified at time of analysis, so this is best handled as a standard patch-cycle item rather than an emergency.
Webkul Aureus ERP through 1.6.0 fails to enforce sufficient password-strength requirements in the user creation/edit form implemented in UserForm.php, allowing accounts to be configured with weak passwords. Remote attackers without prior authentication (PR:N) can exploit this weakness through online password guessing or brute-force attempts, although exploitation is considered difficult (CVSS AC:H) and the direct impact is limited to low confidentiality. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV), and the CVSS 4.0 score is 2.9.
Sensitive information exposure in Webkul Aureus ERP through 1.6.0 allows unauthenticated remote attackers to retrieve debugging-related data reachable via composer.json, and publicly available exploit code exists. The CVSS 4.0 vector shows network reachability with no privileges or user interaction and only low confidentiality impact; integrity and availability are unaffected, and there is no CISA KEV confirmation. Real-world risk is limited to deployments that expose composer.json or associated debug/metadata output, with the product's narrow footprint further reducing exposure.
Stored cross-site scripting in Webkul's Aureus ERP through version 1.6.0 allows an authenticated user holding permission to create Public Holidays or Mandatory Days to store JavaScript in a holiday name, which is then rendered unescaped as an HtmlString inside the Time-Off plugin's Holiday modal. The payload executes in the browser of any HR manager or administrator who opens that modal, enabling session hijacking or privileged actions in the victim's context. Publicly available exploit code exists, but the issue is moderate-priority rather than an emergency: the CVSS 4.0 vector (PR:L/UI:P) requires a valid low-privilege account with holiday-creation rights, and the script only fires when a privileged user actually opens the affected modal rather than self-triggering.
Stored cross-site scripting in Aureus ERP through 1.6.0 allows an authenticated user to upload an SVG file containing embedded JavaScript that is written to the application's public disk and served from the application origin, so the script executes in a victim's browser session when the uploaded file's direct URL is opened. Successful exploitation enables theft of session cookies and CSRF tokens, giving the attacker the ability to act as the victim within the ERP; independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (vendor score 5.1), reflecting a cross-site scripted response that requires a second user to open the crafted file URL. Exploitation prerequisites are non-trivial - the attacker must hold an authenticated account with access to a file-upload field and the victim must navigate to the stored file - and no public exploit identified at time of analysis, so this is best handled as a standard patch-cycle item rather than an emergency.