Approved changes feed: RSS · Atom
cpe:2.3:a:aureuserp:aureuserp:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Aureuserp (bc706f87-423e-57b7-baeb-24dbac9dd856) |
|---|---|
| Product | Aureuserp (28b70e04-361b-5790-83a1-1d3dc0c8c2d4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-95655 |
vulnerable | 2026-10-13 12:28:40.503411 |
Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanel
HIGH (8.1)
Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes in the system.
Published: 2026-09-22T15:24:13.836Z
Updated: 2026-10-06T13:37:05.560Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-94387 |
vulnerable | 2026-10-13 12:28:38.938608 |
Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change Log
MEDIUM (5.4)
Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where old_value and new_value entries are rendered without proper escaping. Any user permitted to edit tracked text fields can inject malicious markup that executes when other users, including administrators, view the record's Chatter panel.
Published: 2026-09-21T13:43:36.234Z
Updated: 2026-10-06T13:37:04.825Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.