Vulnerability Database

299,584

Total vulnerabilities in the database

CVE-2022-23058

ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover.

  • Published: Jun 22, 2022
  • Updated: May 9, 2024
  • CVE: CVE-2022-23058
  • Severity: Low
  • Exploit:

CVSS v2:

  • Severity: Low
  • Score: 3.5
  • AV:N/AC:M/Au:S/C:N/I:P/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
frappe / erpnext 12.0.9 13.1.0