These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability was detected in Webkul Aureus ERP up to 1.6.0, impacting an unknown function of the file plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php. The vulnerability results in weak password requirements due to manipulation of the Password argument. Remote exploitation is possible but has a high complexity and is considered difficult to exploit. The exploit is now pu [truncated]
Aureus ERP contains a stored cross-site scripting vulnerability through 1.6.0 in HolidayAction.php, permitting authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. This vulnerability allows attackers with permissions to create Public Holidays or Mandatory Days to store JavaScript payloads that execute when HR managers or administrators open the Holiday modal, potential [truncated]
CVE-2026-109393 is a MEDIUM-severity vulnerability affecting QloApps version 1.7.0 and earlier. An insecure direct object reference vulnerability exists in back-office AJAX handlers of AdminOrdersController, AdminBookingDocumentController, AdminProductsController, and AdminAddHotelController. This vulnerability allows hotel-restricted employees to access, upload, and delete booking documents and delete ro [truncated]
CVE-2026-107702 debrief: QloApps 1.7.0 authorization bypass vulnerability allows restricted employees to access other hotels' data by manipulating the id_hotel parameter in AdminHotelRoomsBookingController::postProcess(). Hotel management system administrators and security teams should assess exposure and prioritize remediation based on the CVE Program record and NVD vulnerability detail page information. [truncated]
CVE-2026-105836 is an authorization bypass vulnerability in QloApps version 1.7.0 and earlier. The vulnerability allows hotel-restricted back-office employees to modify rooms of other hotels through the ajaxProcessBulkUpdateRooms function. This could disrupt availability and bookings. The vulnerability has a medium severity and defenders should prioritize verifying exposure and assessing the impact on the [truncated]
Aureus ERP 1.6.0 contains a stored XSS vulnerability via SVG file upload. The vulnerability allows authenticated users to upload malicious SVG files containing JavaScript, which can be executed when the file URL is opened directly, enabling session cookie theft and CSRF token exfiltration. Defenders and administrators should assess exposure and prioritize remediation to prevent potential unauthorized acti [truncated]
CVE-2026-95655 debrief based on 9 source links from the CVE Program, NIST NVD, and [email protected]. The CVE record was published on 2026-09-22T16:18:18.943Z and has not been modified since then. The NVD entry is currently Deferred. This issue in Aureus ERP before 1.5.0 allows authenticated users to access arbitrary messages in ChatterPanel by submitting sequential message IDs, potentially enablin [truncated]
CVE-2026-94387 is a stored cross-site scripting vulnerability in the Chatter field-change log of Aureus ERP before version 1.6.0. The vulnerability allows users with permission to edit tracked text fields to inject malicious markup that executes when other users, including administrators, view the record's Chatter panel. This vulnerability has a CVSS score of 5.1 and a severity of MEDIUM. Defenders respon [truncated]
CVE-2026-93988 is a path traversal vulnerability in QloApps version 1.7.0 and earlier, allowing authenticated back-office users to read arbitrary files through the getEmailHTML action in admin/ajax.php. This vulnerability enables attackers to bypass directory restrictions and access sensitive files, including database credentials and configuration data. Defenders responsible for QloApps installations shou [truncated]
CVE-2026-93454 is a stored cross-site scripting (XSS) vulnerability in the Aureus ERP system, specifically in the payment term note field. An authenticated user with payment-term create permission can submit arbitrary JavaScript, which persists in the database and executes in the browsers of all users viewing that payment term record. This vulnerability allows attackers to potentially steal data, take una [truncated]
CVE-2026-79411 is a high-severity vulnerability in Webkul Bagisto 2.4.9 that allows an authenticated backend user with limited permissions to escalate to full administrator privileges. The vulnerability exists in the admin user-management component, specifically in the user-update endpoint, which does not properly verify the actor's permissions or restrict role assignments.
CVE-2026-79410 is a high-severity vulnerability in Webkul Bagisto v2.4.9, allowing authenticated attackers to manipulate order totals by exploiting improper validation of the quantity parameter in the add-to-cart path. This could lead to potential unauthorized modifications to order totals, possible financial impacts, and reputational damage. Defenders and administrators should assess exposure, prioritize [truncated]
CVE-2026-79409 debrief based on the supplied source corpus. The vulnerability affects Webkul Bagisto 2.4.9, allowing remote attackers to obtain sensitive information via the add-to-cart API and downloadable fulfilment components. Defenders should assess exposure and prioritize verification of sensitive information disclosure risks in their deployments. The CVSS score is 6.5, indicating a medium severity v [truncated]
CVE-2026-89268 is a reflected XSS vulnerability in QloApps version 1.7.0. The vulnerability occurs when the application renders back-office list filter POST parameters into HTML input value attributes without proper escaping. An attacker can exploit this by inducing an authenticated user to submit a crafted POST request, allowing the execution of arbitrary JavaScript in the victim's session. This can lead [truncated]
CVE-2026-60120 is a stored cross-site scripting vulnerability in Bagisto before version 2.4.4. The vulnerability is caused by client-side template injection that allows unauthenticated attackers to execute arbitrary JavaScript in administrator browsers. This is achieved by registering a customer account with a malicious payload in the first or last name field. The create.blade.php template renders custome [truncated]
CVE-2017-20262 is a high-severity SQL injection vulnerability in Joomla! Component Ajax Quiz 1.8. Unaffected product versions and vendors are unknown. The CVE was published on June 19, 2026. Attackers can inject malicious SQL code through the cid parameter in GET requests to index.php with option=com_ajaxquiz and view=ajaxquiz parameters. This allows extraction of sensitive database information, including [truncated]
CVE-2026-9506 is a high-severity path traversal vulnerability in the ImageCacheController component of Bagisto. This vulnerability, with a CVSS score of 8.7, allows an unauthenticated remote attacker to access arbitrary files outside the intended directory by sending crafted path traversal sequences through the filename parameter. Successful exploitation could enable an attacker to read arbitrary sensitiv [truncated]