PT-2026-106089 · Undefined · Undefined
CVE-2026-64818
·
Published
2026-10-02
·
Updated
2026-10-02
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
🚨 CVE-2026-97062
Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the file URL is opened directly, enabling session cookie theft and CSRF token exfiltration.
🎖@cveNotify
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Undefined