CVE-2022-28598

ERPNext - 12.29.0 ERPNext 12.29.0の「My Setting」ページにある「lastknownversion」フィールドに保存型クロスサイトスクリプティング（XSS）の脆弱性が存在します。リモートの攻撃者は、認証済みのPOST HTTPリクエストを「/deskForm/User/認証ユーザー」に送信し、細工したサイト名を使用して任意のWebスクリプトまたはHTMLを注入できます。スクリプトは「lastknownversion」フィールドに注入され、「pdf」表示フォームをクリックすることで確認できます。 この脆弱性は特に「My...

ERPNext 12.29 Cross Site Scripting

Exploit Title: ERPNext 12.29 - Cross-Site Scripting XSS Date: 7 Feb 2023 Exploit Author: Patrick Dean Ramos / Nathu Nandwani / Junnair Manla Github - https://github.com/patrickdeanramos/CVE-2022-28598 Vendor Homepage: https://erpnext.com/ Version: 12.29 CVE-2022-28598 Summary: Stored cross-site...

ERPNext 12.29 - Cross-Site Scripting (XSS)

Exploit Title: ERPNext 12.29 - Cross-Site Scripting XSS Date: 7 Feb 2023 Exploit Author: Patrick Dean Ramos / Nathu Nandwani / Junnair Manla Github - https://github.com/patrickdeanramos/CVE-2022-28598 Vendor Homepage: https://erpnext.com/ Version: 12.29 CVE-2022-28598 Summary: Stored cross-site...

Cross site scripting

ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover...

CVE-2022-23058 ERPNext - Stored XSS in My Settings

ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover...