Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: frappe unspecified Clear all filters
TI-2022-07229 CVE-2022-23055 · GHSA-gxgf-4cfv-cmq2

ERPNext - Improper user access conrol

Priority LOW 27

In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality.

CVSS 2.0MEDIUM 5.5 Network Low privileges Interaction — EPSS 0.01197 Published 2022-06-22 No fix listed CWE-862
TI-2022-07232 CVE-2022-23058 · GHSA-7vf8-fmww-vhhv

ERPNext - Stored XSS in My Settings

Priority LOW 18

ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover.

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.00852 Published 2022-06-22 No fix listed CWE-79
TI-2022-07231 CVE-2022-23057 · GHSA-943f-w732-4jf9

ERPNext - Stored XSS in My Profile

Priority LOW 25

In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00621 Published 2022-06-22 No fix listed CWE-79