CVE-2022-23057

2022-06-2208:15:07

Google

osv.dev

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.6%

JSON

In ERPNext, versions v12.0.9–v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile.

CPENameOperatorVersion
erpnexteq6.27.5
erpnexteq8.0.49
erpnexteq6.7.9
erpnexteq4.4.5
erpnexteq10.1.60
erpnexteq11.0.3-beta.6
erpnexteq10.1.72
erpnexteq11.1.21
erpnexteq5.0.22
erpnexteq6.4.6

Name	Operator	Version
erpnext	eq	6.27.5
erpnext	eq	8.0.49
erpnext	eq	6.7.9
erpnext	eq	4.4.5
erpnext	eq	10.1.60
erpnext	eq	11.0.3-beta.6
erpnext	eq	10.1.72
erpnext	eq	11.1.21
erpnext	eq	5.0.22
erpnext	eq	6.4.6