# CVE-2026-110878: Aureus ERP stored cross-site scripting in Inventory Rules

Source: https://junglewise.ai/threats/cve-2026-110878-aureus-erp-through-1-6-0-contains-a-stored-cross-site-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-110878 · Severity: medium · CVSS 5.4 · Published 2026-10-15

Aureus ERP is open-source enterprise resource planning software used to manage inventory and operations. An authenticated attacker can inject malicious JavaScript code into Inventory Rule names that executes when warehouse managers or administrators view or edit those rules, potentially allowing unauthorized actions in their accounts.

Technologies: [Aureus ERP](https://junglewise.ai/threats/technologies/aureus-aureus-erp). Vendors: [Aureus](https://junglewise.ai/threats/vendors/aureus).

## Quick answers

**Is CVE-2026-110878 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110878 being exploited in the wild.

**How severe is CVE-2026-110878?** Medium severity, with a CVSS score of 5.4, published 15 October 2026.

**Which products and versions are affected?** Aureus ERP through 1.6.0.

**Is there a fix for CVE-2026-110878?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-110878 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-110878?** Check whether you run Aureus ERP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in RuleForm.php and RuleInfolist.php where Operation Type and Location names are not properly escaped before output. Authenticated users can inject HTML/JavaScript payloads that persist in the database and execute in the browser context of warehouse managers or administrators viewing Inventory Rules, allowing session hijacking or unauthorized operations.

## Affected products

- Aureus ERP through 1.6.0

## Timeline

- 2026-10-15: disclosed

## References

- [https://github.com/aureuserp/aureuserp](https://github.com/aureuserp/aureuserp)
- [https://github.com/aureuserp/aureuserp/blob/b33fa04643a936885f83b5ad39a62260ef27a7a0/plugins/webkul/inventories/src/Filament/Clusters/Configurations/Resources/RuleResource/Schemas/RuleForm.php](https://github.com/aureuserp/aureuserp/blob/b33fa04643a936885f83b5ad39a62260ef27a7a0/plugins/webkul/inventories/src/Filament/Clusters/Configurations/Resources/RuleResource/Schemas/RuleForm.php)

## Related threats

- [Aureus ERP stored cross-site scripting in HolidayAction](https://junglewise.ai/threats/cve-2026-111284-aureus-erp-through-1-6-0-contains-a-stored-cross-site-scripting)
- [Aureus ERP stored XSS in uploaded SVG files](https://junglewise.ai/threats/cve-2026-97062-aureus-erp-through-1-6-0-stores-uploaded-svg-files-on-its-public)
- [Aureus ERP stored cross-site scripting in Chatter field-change log](https://junglewise.ai/threats/cve-2026-94387-aureus-erp-before-1-6-0-contains-a-stored-cross-site-scripting)