Threats affecting pkg:composer/Aureus ERP

CVE-2026-93454 is a cross-site scripting (XSS) vulnerability in Webkul Aureus ERP up to version 1.6.0. The vulnerability arises because the Payment Term note field is stored without sanitization and rendered as raw HTML in the Accounting plugin. Authenticated users with permission to create payment terms can inject arbitrary JavaScript, which is then stored and executed in the browsers of users viewing the affected Payment Term record. This vulnerability has a medium severity rating with a CVSS score of 5.1.