{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4175", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-14T15:15:06.380Z", "datePublished": "2026-03-15T10:32:14.092Z", "dateUpdated": "2026-03-17T15:16:24.573Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-15T10:32:14.092Z"}, "title": "Aureus ERP Chatter Message content-text-entry.blade.php cross site scripting", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "Cross Site Scripting"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}], "affected": [{"vendor": "Aureus", "product": "ERP", "versions": [{"version": "1.3.0-BETA2", "status": "affected"}, {"version": "1.3.0-BETA1", "status": "unaffected"}], "modules": ["Chatter Message Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in Aureus ERP up to 1.3.0-BETA2. The affected element is an unknown function of the file plugins/webkul/chatter/resources/views/filament/infolists/components/messages/content-text-entry.blade.php of the component Chatter Message Handler. Executing a manipulation of the argument subject/body can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 1.3.0-BETA1 is sufficient to fix this issue. This patch is called 2135ee7efff4090e70050b63015ab5e268760ec8. It is suggested to upgrade the affected component."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:OF/RC:C"}}], "timeline": [{"time": "2026-03-14T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-14T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-14T16:20:11.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "kkc73 (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.351083", "name": "VDB-351083 | Aureus ERP Chatter Message content-text-entry.blade.php cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.351083", "name": "VDB-351083 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.769827", "name": "Submit #769827 | aureuserp 51b975a Cross Site Scripting", "tags": ["third-party-advisory"]}, {"url": "https://github.com/aureuserp/aureuserp/pull/939", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/aureuserp/aureuserp/commit/2135ee7efff4090e70050b63015ab5e268760ec8", "tags": ["patch"]}, {"url": "https://github.com/aureuserp/aureuserp/releases/tag/v1.3.0-BETA1", "tags": ["patch"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-17T15:16:12.610001Z", "id": "CVE-2026-4175", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T15:16:24.573Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4175", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-17T15:16:12.610001Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T15:16:20.529Z"}}], "cna": {"tags": ["x_open-source"], "title": "Aureus ERP Chatter Message content-text-entry.blade.php cross site scripting", "credits": [{"lang": "en", "type": "reporter", "value": "kkc73 (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:OF/RC:C"}}], "affected": [{"vendor": "Aureus", "modules": ["Chatter Message Handler"], "product": "ERP", "versions": [{"status": "affected", "version": "1.3.0-BETA2"}, {"status": "unaffected", "version": "1.3.0-BETA1"}]}], "timeline": [{"lang": "en", "time": "2026-03-14T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-14T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-14T16:20:11.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.351083", "name": "VDB-351083 | Aureus ERP Chatter Message content-text-entry.blade.php cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.351083", "name": "VDB-351083 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.769827", "name": "Submit #769827 | aureuserp 51b975a Cross Site Scripting", "tags": ["third-party-advisory"]}, {"url": "https://github.com/aureuserp/aureuserp/pull/939", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/aureuserp/aureuserp/commit/2135ee7efff4090e70050b63015ab5e268760ec8", "tags": ["patch"]}, {"url": "https://github.com/aureuserp/aureuserp/releases/tag/v1.3.0-BETA1", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in Aureus ERP up to 1.3.0-BETA2. The affected element is an unknown function of the file plugins/webkul/chatter/resources/views/filament/infolists/components/messages/content-text-entry.blade.php of the component Chatter Message Handler. Executing a manipulation of the argument subject/body can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 1.3.0-BETA1 is sufficient to fix this issue. This patch is called 2135ee7efff4090e70050b63015ab5e268760ec8. It is suggested to upgrade the affected component."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Cross Site Scripting"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-15T10:32:14.092Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4175", "state": "PUBLISHED", "dateUpdated": "2026-03-17T15:16:24.573Z", "dateReserved": "2026-03-14T15:15:06.380Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-15T10:32:14.092Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in Aureus ERP up to 1.3.0-BETA2. The affected element is an unknown function of the file plugins/webkul/chatter/resources/views/filament/infolists/components/messages/content-text-entry.blade.php of the component Chatter Message Handler. Executing a manipulation of the argument subject/body can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 1.3.0-BETA1 is sufficient to fix this issue. This patch is called 2135ee7efff4090e70050b63015ab5e268760ec8. It is suggested to upgrade the affected component."}, {"lang": "es", "value": "Se determin\u00f3 una vulnerabilidad en Aureus ERP hasta la versi\u00f3n 1.3.0-BETA2. El elemento afectado es una funci\u00f3n desconocida del archivo plugins/webkul/chatter/resources/views/filament/infolists/components/messages/content-text-entry.blade.php del componente Chatter Message Gestor. La ejecuci\u00f3n de una manipulaci\u00f3n del argumento subject/body puede conducir a cross-site scripting. El ataque puede lanzarse de forma remota. La actualizaci\u00f3n a la versi\u00f3n 1.3.0-BETA1 es suficiente para solucionar este problema. Este parche se llama 2135ee7efff4090e70050b63015ab5e268760ec8. Se sugiere actualizar el componente afectado."}], "id": "CVE-2026-4175", "lastModified": "2026-04-22T21:32:08.360", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}]}, "published": "2026-03-16T14:19:58.163", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/aureuserp/aureuserp/commit/2135ee7efff4090e70050b63015ab5e268760ec8"}, {"source": "cna@vuldb.com", "url": "https://github.com/aureuserp/aureuserp/pull/939"}, {"source": "cna@vuldb.com", "url": "https://github.com/aureuserp/aureuserp/releases/tag/v1.3.0-BETA1"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.351083"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.351083"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.769827"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}], "source": "cna@vuldb.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.3.0-BETA2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.3.0-BETA1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "ERP", "source": "cna", "vendor": "Aureus"}, "product": "erp", "vendor": "aureus"}], "analysis": {"en": {"generated_at": "2026-04-15T08:37:07.931361+00:00", "value": {"mitigation_remediation": ["Upgrade Aureus ERP to version 1.3.0\u2011BETA1 or later, which includes the patch commit 2135ee7efff4090e70050b63015ab5e268760ec8.", "If an upgrade is not immediately possible, disable the Chatter message posting feature or restrict it to trusted users until a patch is applied.", "Configure the web application to enforce strict content\u2011security policies and server\u2011side output escaping to mitigate potential XSS even if the underlying flaw persists."], "summary": {"action": "Patch Now", "impact": "Cross\u2011site scripting"}, "threat_synthesis": {"affected_systems": "The vulnerable product is Aureus:ERP. Versions up to 1.3.0\u2011BETA2 include the issue, while the patch commit 2135ee7efff4090e70050b63015ab5e268760ec8 is incorporated in version 1.3.0\u2011BETA1, indicating that releases 1.3.0\u2011BETA1 and later are expected to contain the fix.", "description_and_impact": "A vulnerability exists in Aureus ERP\u2019s Chatter Message Handler component, specifically in the file plugins/webkul/chatter/resources/views/filament/infolists/components/messages/content-text-entry.blade.php. The flaw arises from insufficient sanitization of the subject and body arguments, allowing an attacker to inject arbitrary client\u2011side script when a user views a malicious message. This stored XSS (CWE\u201179) could also permit code injection (CWE\u201194) depending on the execution context.", "risk_and_exploitability": "The CVSS score of 5.1 indicates moderate severity, and the EPSS score of less than 1\u202f% suggests a low likelihood of active exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires remote access to the application and the ability to submit crafted message content via the Chatter interface; once a victim views the stored message, the attacker\u2019s injected script will execute in the victim\u2019s browser."}}}}, "created": "2026-03-16T09:21:53.770578+00:00", "updated": "2026-04-15T16:45:09.840598+00:00", "vendors": ["aureus", "aureus$PRODUCT$erp"]}