जमा करें #972881: Webkul Aureus ERP v1.6.0 Cross Site Scripting

A stored Cross-Site Scripting (XSS) vulnerability exists in the Payment Term note field of AureusERP v1.6.0. The Payment Term REST API accepts arbitrary HTML/JavaScript in the note parameter without performing server-side sanitization, as the field is validated only as a nullable string. The stored value is subsequently rendered by the Filament admin panel using HtmlString, causing the application to output the content as raw HTML without sanitization. Although the TipTap-based admin interface does not normally allow direct <script> injection because its editor representation escapes such content, an authenticated user with permission to update Payment Terms can bypass this client-side restriction by submitting a crafted payload directly to the REST API. Once stored, the payload executes in the browser of any user who subsequently views the affected Payment Term record, including administrators. Because the JavaScript executes within the application's origin and the victim's authenticated browser session, it may perform actions and access data permitted to the victim's account, making this a persistent stored XSS vulnerability.

Researchers Information

Researcher - 1

Name: Karan Parelkar

Independent Security Researcher

Email: [email protected]

GitHub: https://github.com/KaranParelkar

LinkedIn: https://www.linkedin.com/in/karan-parelkar-6a370125b/

Researcher - 2

Name: Devansh Sanghvi

Independent Security Researcher

Email: [email protected]

GitHub: https://github.com/Devansh10845

LinkedIn: https://www.linkedin.com/in/devansh-sanghvi-16570325b/

• स्रोत: ⚠️ https://github.com/KaranParelkar/Auresus_vulnerability/blob/main/Stored_XSS/Readme.md
• उपयोगकर्ता: KaranParelkar (UID 99714)
• सबमिशन: 11/09/2026 10:47 AM (1 महीना पहले)
• संयम: 11/10/2026 03:57 PM (1 month later)
• स्थिति: प्रतिलिपि
• VulDB प्रविष्टि: 407321 [Webkul Aureus ERP तक 1.6.0 Accounting Plugin Payment Term note क्रॉस साइट स्क्रिप्टिंग]
• अंक: 0