| Package | Affected versions | Patched versions |
|---|---|---|
| erpnext | ≤ 15.88.1 |
A Stored Cross-Site Scripting (XSS) vulnerability was discovered within the CSV import mechanism of ERPNext thru 15.88.1 when using the Update Existing Recordsoption. An attacker can embed malicious JavaScript code into a CSV field, which is then stored in the database and executed whenever the affected record is viewed by a user within the ERPNext web interface. This exposure may allow an attacker to compromise user sessions or perform unauthorized actions under the context of a victim's account.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free