CVE-2026-111284: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Webkul Aureus ERP

Webkul Aureus ERP through version 1.6.0 contains a stored cross-site scripting vulnerability in the HolidayAction.php file. Authenticated users authorized to create Public Holidays or Mandatory Days can inject JavaScript payloads through unescaped holiday name inputs rendered as HtmlString. When HR managers or administrators open the Holiday modal, the stored scripts execute, enabling session hijacking or other script-based attacks.

The vulnerability allows authenticated users with specific permissions to inject malicious scripts that execute in the context of HR managers or administrators. This can lead to session hijacking and unauthorized actions performed with elevated privileges. The CVSS 4.0 base score is 5.1 (medium severity), indicating a moderate risk due to the need for authentication and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict permissions to create Public Holidays or Mandatory Days to trusted users only and avoid opening the Holiday modal with untrusted inputs. Monitor vendor channels for updates and apply patches promptly once released.