A vulnerability exists in Aureus ERP’s Chatter Message Handler component, specifically in the file plugins/webkul/chatter/resources/views/filament/infolists/components/messages/content-text-entry.blade.php. The flaw arises from insufficient sanitization of the subject and body arguments, allowing an attacker to inject arbitrary client‑side script when a user views a malicious message. This stored XSS (CWE‑79) could also permit code injection (CWE‑94) depending on the execution context.

The vulnerable product is Aureus:ERP. Versions up to 1.3.0‑BETA2 include the issue, while the patch commit 2135ee7efff4090e70050b63015ab5e268760ec8 is incorporated in version 1.3.0‑BETA1, indicating that releases 1.3.0‑BETA1 and later are expected to contain the fix.

The CVSS score of 5.1 indicates moderate severity, and the EPSS score of less than 1 % suggests a low likelihood of active exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires remote access to the application and the ability to submit crafted message content via the Chatter interface; once a victim views the stored message, the attacker’s injected script will execute in the victim’s browser.