Filtered by vendor Frappe Subscriptions
Filtered by product Erpnext Subscriptions
Total 17 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-28598 1 Frappe 1 Erpnext 2024-11-21 6.1 Medium
Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2022-23058 1 Frappe 1 Erpnext 2024-11-21 N/A
ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover.
CVE-2022-23057 1 Frappe 1 Erpnext 2024-11-21 5.4 Medium
In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile.
CVE-2022-23056 1 Frappe 1 Erpnext 2024-11-21 N/A
In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack.
CVE-2022-23055 1 Frappe 1 Erpnext 2024-11-21 N/A
In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of other users.
CVE-2020-6145 1 Frappe 1 Erpnext 2024-11-21 8.8 High
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVE-2019-20521 1 Frappe 1 Erpnext 2024-11-21 6.1 Medium
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI.
CVE-2019-20520 1 Frappe 1 Erpnext 2024-11-21 6.1 Medium
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI.
CVE-2019-20519 1 Frappe 1 Erpnext 2024-11-21 6.1 Medium
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address.
CVE-2019-20518 1 Frappe 1 Erpnext 2024-11-21 6.1 Medium
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI.
CVE-2019-20517 1 Frappe 1 Erpnext 2024-11-21 6.1 Medium
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI.
CVE-2019-20516 1 Frappe 1 Erpnext 2024-11-21 6.1 Medium
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI.
CVE-2019-20515 1 Frappe 1 Erpnext 2024-11-21 6.1 Medium
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI.
CVE-2019-20514 1 Frappe 1 Erpnext 2024-11-21 6.1 Medium
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI.
CVE-2019-20511 1 Frappe 1 Erpnext 2024-11-21 6.1 Medium
ERPNext 11.1.47 allows blog?blog_category= Frame Injection.
CVE-2018-20061 1 Frappe 1 Erpnext 2024-11-21 N/A
A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that calls a server-side Python function with carefully chosen arguments, a SQL attack can be carried out which allows SQL queries to be constructed to return any columns from any tables in the database. This is related to /api/resource/Item?fields= URIs, frappe.get_list, and frappe.call.
CVE-2018-11339 1 Frappe 1 Erpnext 2024-11-21 N/A
An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment.