Frappe ≫ Erpnext

ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover.

In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile.

In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack.

An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI.

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI.

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address.

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI.

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI.

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI.