Skip to content
Threat Feed
Subscribe

Tag

Erpnext

2 briefs RSS
high advisory

Reflected Cross-Site Scripting Vulnerability in Frappe ERPNext

Frappe ERPNext versions before 14.92.1 and 15.x before 15.83.0 are susceptible to reflected XSS, allowing unauthenticated attackers to execute arbitrary JavaScript in authenticated sessions.

ERPNext +3 vulnerability authorization-bypass server-side-template-injection web-application-vulnerability
4t 1c
critical advisory

Frappe Framework ERPNext 13.4.0 Sandbox Escape Vulnerability

Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability allowing authenticated users with System Manager role to execute arbitrary code via frame introspection and `os.popen`.

ERPNext +1 sandbox-escape rce
2r 1t 1c