Aureus ERP before version 1.6.0 contains a stored XSS vulnerability in the Chatter field-change log. Specifically, the old_value and new_value fields are not properly escaped during web page generation, allowing injection of malicious markup. This vulnerability can be exploited by any user authorized to edit tracked text fields, leading to script execution in the context of other users viewing the Chatter panel, including administrators.

Successful exploitation allows an attacker with edit permissions on tracked text fields to inject malicious scripts that execute in the browsers of other users viewing the Chatter panel. This can lead to session hijacking, unauthorized actions, or other impacts typical of stored XSS vulnerabilities. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low complexity, and limited user interaction.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict permissions to edit tracked text fields to trusted users only and consider monitoring or limiting access to the Chatter panel.