This vulnerability resides in the HolidayAction.php file of Aureus ERP and allows authenticated users with holiday creation rights to store malicious JavaScript in holiday names. The stored script is later rendered inside an HTML string when a human resources manager or administrator opens the holiday modal, causing the injected code to execute in the victim’s browser. The result is a typical stored cross‑site scripting flaw that can lead to session hijacking and potential compromise of sensitive HR operations.

The flaw affects Webkul Aureus ERP versions up to and including 1.6.0. Any deployment of the product in that version range that permits users to create Public Holidays or Mandatory Days is susceptible.

The CVSS score of 5.1 classifies the issue as moderate severity, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score of <1% indicates a very low probability of exploitation at any given time, but since the flaw still requires authentication and enables the execution of arbitrary scripts in an administrator’s browser, the risk of session hijacking or escalation remains significant. Attackers would first need a valid user account with holiday‑creation privileges, after which the malicious payload would be delivered to targets who view the holiday modal.