CVE-2026-111284

Medium · CVSS 5.1

Published 2026-10-15

CVSS

5.1

Medium

EPSS

—

exploit probability

Active Exploit

not yet listed

Medium — next window — Medium severity. Include in your next scheduled maintenance window.

What is CVE-2026-111284?

Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads that execute when HR managers or administrators open the Holiday modal, hijacking their sessions.

Likely affects:Java / SpringPHP

CVSS Score Explained

CVSS 5.1 is Medium severity. Exploitation usually requires some specific conditions (local access, user interaction, or a particular config). Still worth patching in your next maintenance window.

EPSS Exploitation Probability

No EPSS score yet — model needs more data on this CVE.

References & Patches

Track vulnerabilities for your stack

Tell us what tech you run — Node.js, Python, Java, nginx, whatever — and get a weekly email when new CVEs affect it.

Set up my stack watchlist What is a CVE?

Recent CVEs

Browse all CVEs →CISA KEV list →My watchlist →