CVE-2026-4175

Aureus ERP Chatter Message content-text-entry.blade.php cross site scripting

State: Published
Severity: 5.1 Medium
Published: Mar 15, 2026
Updated: Mar 17, 2026
Reserved: Mar 14, 2026

Description

A vulnerability was determined in Aureus ERP up to 1.3.0-BETA2. The affected element is an unknown function of the file plugins/webkul/chatter/resources/views/filament/infolists/components/messages/content-text-entry.blade.php of the component Chatter Message Handler. Executing a manipulation of the argument subject/body can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 1.3.0-BETA1 is sufficient to fix this issue. This patch is called 2135ee7efff4090e70050b63015ab5e268760ec8. It is suggested to upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X	VulDB
3.1	3.5 Low	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C	VulDB
3.0	3.5 Low	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C	VulDB
2.0	4.0 Medium	AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-79 Cross Site Scripting
CWE-94 Code Injection

Affected Products

Product	Versions
ERPAureus	1.3.0-BETA2Affected 1.3.0-BETA1Not affected

References

VDB-351083 | Aureus ERP Chatter Message content-text-entry.blade.php cross site scriptingvdb-entrytechnical-description
VDB-351083 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #769827 | aureuserp 51b975a Cross Site Scriptingthird-party-advisory
https://github.com/aureuserp/aureuserp/pull/939issue-trackingpatch
https://github.com/aureuserp/aureuserp/commit/2135ee7efff4090e70050b63015ab5e268760ec8patch
https://github.com/aureuserp/aureuserp/releases/tag/v1.3.0-BETA1patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.