CVE-2026-94387

Name of the Vulnerable Software and Affected Versions Aureus ERP versions prior to 1.6.0

Description A stored cross-site scripting issue exists in the Chatter field-change log. The system fails to properly escape the old value and new value entries. This allows a user with permissions to edit tracked text fields to inject malicious markup, which then executes in the browser of other users, including administrators, when they view the record's Chatter panel.

Recommendations Update Aureus ERP to version 1.6.0 or later.