{"action":"Upgrade aureuserp/aureuserp to 1.3.0-BETA1 or later.","affected":[{"fixed":"1.3.0-BETA1","introduced":"0"}],"component":"aureuserp/aureuserp","cve_ids":["CVE-2026-4175"],"ecosystem":"Packagist","exploited":false,"fixed_versions":["1.3.0-BETA1"],"ghsa_id":"GHSA-76c2-3q6g-xvpm","id":"tcs_01M5KEXRN4H3BDA3XPRQBKD3FT","modified_at":"2026-03-17T20:26:20.826824Z","published_at":"2026-03-16T15:30:44Z","references":["https://osv.dev/vulnerability/GHSA-76c2-3q6g-xvpm","https://nvd.nist.gov/vuln/detail/CVE-2026-4175","https://github.com/aureuserp/aureuserp/pull/939","https://github.com/aureuserp/aureuserp/commit/2135ee7efff4090e70050b63015ab5e268760ec8","https://github.com/aureuserp/aureuserp","https://github.com/aureuserp/aureuserp/releases/tag/v1.3.0-BETA1","https://vuldb.com/?ctiid.351083","https://vuldb.com/?id.351083","https://vuldb.com/?submit.769827"],"severity":{"label":"low","score":3.5},"sources":[{"source":"osv","source_id":"GHSA-76c2-3q6g-xvpm","url":"https://osv.dev/vulnerability/GHSA-76c2-3q6g-xvpm"}],"summary":"Aureus ERP vulnerable to cross-site scripting in the Chatter Message Handler"}