Cross site scripting

An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment...