Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change Log

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-94387 · Microsoft / collected KEV context

cve-program · CVE-2026-94387

• https://github.com/aureuserp/aureuserp/commit/57cf5cf4c98d82a0ad89003402f27823fbe1e27c
• https://github.com/aureuserp/aureuserp/pull/1465
• https://github.com/aureuserp/aureuserp/blob/v1.5.0/plugins/webkul/chatter/resources/views/filament/infolists/components/messages/content-text-entry.blade.php#L165
• https://github.com/aureuserp/aureuserp/blob/v1.5.0/plugins/webkul/chatter/resources/views/filament/infolists/components/messages/content-text-entry.blade.php#L182
• https://hackmd.io/@leediay/stored-xss-aureuserp-chatter
• https://github.com/aureuserp/aureuserp/releases/tag/v1.6.0
• https://github.com/aureuserp/aureuserp
• https://www.vulncheck.com/advisories/aureus-erp-before-1.6.0-stored-xss-via-chatter-field-change-log

No related operational record is retained in the current change model.