Description
Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper neutralization. Authenticated attackers can set a crafted user name that executes arbitrary JavaScript in the browsers of other users who view the leaderboard.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
frappe frappe
Default version status: unaffected
0 to < 14.99.10affected15.0.0 to < 15.91.1affected14.99.10unaffected15.91.1unaffected
pkg:pypi/frappe