Description (CNA)
Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in pages. Attackers can submit crafted HTML that bypasses the insufficient escaping and is rendered in the browsers of users who view it, enabling cross-site scripting.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| frappe / frappe | affected 0 before 13.52.0; affected 14.0.0-beta.1 before 14.31.0; unaffected 13.52.0; unaffected 14.31.0 |
CWE
CWE-79
References
- https://github.com/frappe/frappe/security/advisories/GHSA-4jj9-5vgc-gc4j
- https://www.vulncheck.com/advisories/frappe-before-14.31.0-html-injection-via-weak-escaping
ADP enrichment
No English description supplied.
No references supplied.