MEDIUMCVSS v3.1 5.4Vulnerability

CVE-2026-111284

Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads that execute when HR managers or administrators open the Holiday modal, hijacking their sessions.

Properties

Severity
MEDIUM
Nvd fetched at
2026-10-20T21:14:08.448323+00:00
Epss score
0.00215
Cvss severity
MEDIUM
Cvss score
5.4
Retrieved at
2026-10-21T01:24:48+00:00
Last source
FIRST EPSS
Score
5.4
Cvss version
3.1
Cve id
CVE-2026-111284
Cvss vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
First seen by Signal
2026-10-18T13:39:03+00:00
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Published at
2026-10-15T22:19:29.893
Last modified
2026-10-16T20:17:20.110
Epss percentile
0.11223

Related Entities (1)

HAS_WEAKNESS (1)

→[Weakness]Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Explore deeper with Ninja Signal's threat intelligence graph

Search in SpektrOpen Signal Desktop
CVE-2026-111284 (CVSS v3.1 5.4) — Ninja Signal Threat Intelligence | Ninja Signal