CVE-2026-93454

Name of the Vulnerable Software and Affected Versions Aureus ERP versions prior to 1.6.1

Description The Accounting plugin fails to sanitize the Payment Term note field, rendering it as raw HTML. Authenticated users with payment-term create permissions can submit arbitrary JavaScript to the payment-terms endpoint. This script is stored in the database and executes in the browsers of all users who view the affected Payment Term record, leading to a stored Cross-Site Scripting (XSS) condition.

Recommendations Update to a version newer than 1.6.0. Restrict access to the payment-terms endpoint for users who do not strictly require payment-term creation permissions.