CVE-2022-28598
MediumCVSS 6.1Exploitation Probability (EPSS)
High risk87th percentile - higher than 87% of all known CVEs
Summary
Frappe ERPNext version 12.29.0 is vulnerable to XSS attacks. The software does not neutralize or incorrectly neutralizes user-controllable input before placing it in output used as a web page served to other users.
Risk Assessment
An attacker can inject a malicious script that executes in another user's browser, potentially leading to session theft, data leakage, or account takeover.
Recommendation
Immediately upgrade Frappe ERPNext to a version later than 12.29.0 that includes a fix for this vulnerability.
Other vulnerabilities in Frappe ERPNext
See all- CVE-2026-96672Medium
Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values reference whitelisted methods before passing them to frappe.call(). Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and read their return values.
- CVE-2026-94113Medium
Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet endpoints to enumerate and retrieve billable time logs including project names, billing amounts, and work descriptions without proper authorization checks.
Original NVD description (English source)
Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users.