---
id: CVE-2026-111284
title: >-
  Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability
  in HolidayAction.php that allows authenticated users to inject scripts via
  unescaped holiday names rendered as HtmlString
summary: >-
  Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability
  in HolidayAction.php that allows authenticated users to inject scripts via
  unescaped holiday names rendered as HtmlString. Attackers permitted to create
  Public…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: Webkul
product: Aureus ERP
affected:
  - aureus_erp <= 1.6.0
published: '2026-10-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T20:17:20.110'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-111284'
references:
  - url: 'https://github.com/aureuserp/aureuserp'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/time-off/src/Filament/Actions/HolidayAction.php#L42-L63
    label: disclosure@vulncheck.com
  - url: 'https://github.com/aureuserp/aureuserp/pull/1606'
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@leediay/By7ESbAozl'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/aureus-erp-through-1.6.0-stored-xss-via-time-off-holiday-action-modal
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00215
epssPercentile: 0.11823
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T19:42:32.107990Z'
ingestedAt: '2026-10-15T22:48:25.450Z'
---

## Overview

Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads that execute when HR managers or administrators open the Holiday modal, hijacking their sessions.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.