| शीर्षक | aureuserp 51b975a Cross Site Scripting |
|---|
| विवरण | A stored cross-site scripting (XSS) vulnerability exists in the Chatter feature of aureuserp/aureuserp (commit 51b975a) due to unsafe rendering of user-controlled input in the Filament view content-text-entry.blade.php. The subject and body fields of notes/comments are output using Blade’s unescaped syntax ({!! !!}), allowing arbitrary HTML and JavaScript to be injected and persisted. An authenticated attacker who can create or modify Chatter messages can store a malicious payload that will execute in the browser of any user who views the affected record, potentially leading to session compromise, unauthorized actions performed in the victim’s context, and data exfiltration from the application panel. |
|---|
| स्रोत | ⚠️ https://github.com/aureuserp/aureuserp/pull/939 |
|---|
| उपयोगकर्ता | kkc73 (UID 89422) |
|---|
| सबमिशन | 02/03/2026 09:20 AM (5 महीनों पहले) |
|---|
| संयम | 14/03/2026 04:15 PM (12 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 351083 [Aureus ERP तक 1.3.0-BETA2 Chatter Message content-text-entry.blade.php subject/body क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|