Description
Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not escaped before being rendered. Remote attackers can craft a malicious printview URL that, when visited by a victim, injects HTML and executes script in the victim's browser session.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
frappe frappe
Default version status: unaffected
0 to < 14.58.0affected15.0.0 to < 15.4.0affected14.58.0unaffected15.4.0unaffected