Description
In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| frappe | frappe | v12.0.9 – < unspecified, unspecified – ≤ v13.0.3 | unspecified |