Description
In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| erpnext | erpnext | v13.0.0-beta.13 – < unspecified, unspecified – ≤ v13.30.0 | unspecified |