Read the docs

aureuserp

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

aureuserp records in CISA KEV

No aureuserp vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-75418 CVE-2026-111632 · GHSA-2g8j-xm43-8gjj

Aureus ERP Multi-Company Authorization Bypass via company_id

Priority MEDIUM 57

Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a foreign company_id.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00294 Published 2026-10-16 No fix listed CWE-639
TI-2026-74906 CVE-2026-110878

Stored cross-site scripting in Aureus ERP inventory rules

Priority MEDIUM 56

Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type and Location names in RuleForm.php and RuleInfolist.php.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00226 Published 2026-10-15 No fix listed CWE-79
Open these records in search →