CVE-2026-111284Published
Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-111284 · Microsoft / collected KEV context
cve-program · CVE-2026-111284
- https://hackmd.io/@leediay/By7ESbAozl
- https://github.com/aureuserp/aureuserp/pull/1606
- https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/time-off/src/Filament/Actions/HolidayAction.php#L42-L63
- https://github.com/aureuserp/aureuserp
- https://www.vulncheck.com/advisories/aureus-erp-through-1.6.0-stored-xss-via-time-off-holiday-action-modal
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.