CVE-2022-23057

CVE-2022-23057: ERPNext - Stored XSS in My Profile

Vendor Frappe
Product frappe
Weakness CWE-79 · XSS
Published June 22, 2022
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile.

Key dates

02Disclosure timeline

June 22, 2022 CVE published
September 16, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-6719 Cross-site Scripting in Repox CVE-2025-14745 RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wp-rss-aggregator Shortcode CVE-2024-11321 Reflected XSS in Hi e-learning's Learning Management System (LMS) CVE-2024-5189 Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.23 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-4685 Campcodes Complete Web-Based School Management System exam_timetable.php cross site scripting