Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2023-54408

Frappe before 14.31.0 HTML Injection via Weak Escaping

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in pages. Attackers can submit crafted HTML that bypasses the insufficient escaping and is rendered in the browsers of users who view it, enabling cross-site scripting.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

frappe frappe

Default version status: unaffected

  • 0 to < 13.52.0affected
  • 14.0.0-beta.1 to < 14.31.0affected
  • 13.52.0unaffected
  • 14.31.0unaffected

References