Design/Logic Flaw

In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack...

Cross site scripting

ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover...

Cross site scripting

In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting XSS, due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile...

CVE-2022-23058 ERPNext - Stored XSS in My Settings

ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover...

CVE-2022-23058

ERPNext (versions v12.0.9–v13.0.3) is affected by a stored XSS in the username field under My Settings. The vulnerability allows low-privileged users to inject malicious scripts, potentially leading to full account takeover. The available sources confirm the affected versions and the stored XSS v...

CVE-2022-23058 ERPNext - Stored XSS in My Settings

ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover...

CVE-2022-23058

ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover...

CVE-2022-23056

ERPNext CVE-2022-23056: The connected documents confirm a Stored XSS vulnerability on the Patient History page affecting ERPNext versions 13.0.0-beta.13 through 13.30.0. A low-privilege user could potentially perform an account takeover. The root cause, exact payload/exploit details, and official...

CVE-2022-23056 ERPNext - Stored XSS leads to account takover

In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack...

CVE-2022-23056 ERPNext - Stored XSS leads to account takover

In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack...

CVE-2022-23056

In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack...

CVE-2022-23057 ERPNext - Stored XSS in My Profile

In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting XSS, due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile...

CVE-2022-23057

In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting XSS, due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile...

CVE-2022-23057 ERPNext - Stored XSS in My Profile

In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting XSS, due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile...

CVE-2022-23057

In ERPNext, versions v12.0.9–v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly. A low-privilege attacker could inject arbitrary code into input fields when editing a user’s profile. Root cause: unchecked/unsanitized input allowing script ex...

PT-2022-15817

Name of the Vulnerable Software and Affected Versions ERPNext versions v12.0.9 through v13.0.3 Description The issue is related to Stored Cross-Site-Scripting XSS due to improper validation of user input. This allows a low-privileged attacker to inject arbitrary code into input fields when editin...

CVE-2022-23057: Improper Neutralization of Input During Web Page Generation

In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting XSS, due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile...

PT-2022-15815 · Erpnext · Erpnext

Name of the Vulnerable Software and Affected Versions: ERPNext versions v11.0.0-beta through v13.0.2 Description: The issue concerns missing authorization in the chat rooms functionality. A low-privileged attacker can send direct or group messages to any member or group, impersonating themselves ...

ERPNext 安全漏洞

ERPNext is an open source enterprise resource planning solution from ERPNext India. A security vulnerability exists in ERPNext versions v11.0.0-beta through v13.0.2, which stems from vulnerability to lack of authorization in chat room functionality, and can be exploited by an attacker to send a...

CVE-2022-23055: Missing Authorization

In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat...