CPE
Frappe ERPNext versions before 14.92.1 and 15.x before 15.83.0 are susceptible to reflected XSS, allowing unauthenticated attackers to execute arbitrary JavaScript in authenticated sessions.