CVE-2022-28598

MediumCVSS 6.1

Published: 22/08/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

3.20%

87th percentile - higher than 87% of all known CVEs

Summary

Frappe ERPNext version 12.29.0 is vulnerable to XSS attacks. The software does not neutralize or incorrectly neutralizes user-controllable input before placing it in output used as a web page served to other users.

Risk Assessment

An attacker can inject a malicious script that executes in another user's browser, potentially leading to session theft, data leakage, or account takeover.

Recommendation

Immediately upgrade Frappe ERPNext to a version later than 12.29.0 that includes a fix for this vulnerability.

Original NVD description (English source)

Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users.