Aureus ERP vulnerable to cross-site scripting in the Chatter Message Handler
A vulnerability was determined in Aureus ERP up to 1.3.0-BETA1. The affected element is an unknown function of the file plugins/webkul/chatter/resources/views/filament/infolists/components/messages/content-text-entry.blade.php of the component Chatter Message Handler. Executing a manipulation of the argument subject/body can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 1.3.0-BETA1 is sufficient to fix this issue. This patch is called 2135ee7efff4090e70050b63015ab5e268760ec8. It is suggested to upgrade the affected component.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | aureuserp/aureuserp | < 1.3.0-BETA1 | 1.3.0-BETA1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-4175
- https://github.com/aureuserp/aureuserp/pull/939
- https://github.com/aureuserp/aureuserp/commit/2135ee7efff4090e70050b63015ab5e268760ec8
- https://github.com/aureuserp/aureuserp
- https://github.com/aureuserp/aureuserp/releases/tag/v1.3.0-BETA1
- https://vuldb.com/?ctiid.351083
- https://vuldb.com/?id.351083
- https://vuldb.com/?submit.769827
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N- Weakness (CWE)
CWE-79- Platform
- Composer
- Package
aureuserp/aureuserp- Disclosed
- 16.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-76c2-3q6g-xvpm - CC BY 4.0
Vulnerability history: aureuserp/aureuserp
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.