Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as…

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI

ERPNext 11.1.47 allows blog?blog_category= Frame Injection

An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment

ERPNext: Path Traversal Leading to Sensitive File Exposure

Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name

Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name

Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints

Frappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing Authorization

A Stored Cross-Site Scripting (XSS) vulnerability was discovered within the CSV import mechanism of ERPNext thru 15.88.1 when using the Update Existing Recordsoption

A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload…

In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly

ERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literals

Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoints

ERPNext 16.16.0 - Stored XSS in POS cart item rendering

Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification

Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints

Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation

Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification

Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field

Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints

Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints

Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints

Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint

Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization

Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints

ERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup Methods

ERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_html

ERPNext: Unauthorised triggering of automated emails due to missing validation

ERPNext: Possible SSRF by any authenticated user

An SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions method of Frappe ERPNext through 15.89.0

An SSTI (Server-Side Template Injection) vulnerability exists in the get_contract_template method of Frappe ERPNext through 15.89.0

ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks in fields that are intended for plain text