Aureus ERP through version 1.6.0 contains a stored cross‑site scripting flaw that allows authenticated users to insert malicious HTML or JavaScript into the Operation Type and Location names used in inventory rule forms and informational views. When a warehouse manager or administrator later views or edits these inventory rules, the unsanitized content is rendered directly in the browser, causing the injected script to execute in the context of the user’s session. This flaw can be abused to hijack sessions, deface content, or perform other client‑side attacks against privileged users.

Products affected are Aureus ERP versions up to and including 1.6.0. The vulnerability is implemented in the file RuleForm.php and the list view RuleInfolist.php within the inventory plugin. All users who can create or edit inventory rules are potential attackers, while users with the role of warehouse manager or administrator are the ones who can trigger the script execution.

The CVSS score is 5.1, indicating a moderate level of severity, and the EPSS score is less than 1 percent, meaning that only a very small probability of exploitation has been observed. The vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires an authenticated session with permissions to edit inventory rules; the attacker does not need to be privileged beyond that, and the script executes in the session of any user who later views the rule, giving the attacker a broad potential impact in environments with many managers or administrators.