Medium severity5.4NVD Advisory· Published Jun 22, 2022· Updated Jun 17, 2026

CVE-2022-23057

Description

In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Frappe/Erpnext2 versions
cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*range: >=12.0.9,<13.1.0
- (no CPE)range: v12.0.9--v13.0.3
Frappe/Frappellm-fuzzy2 versions
v12.0.9--v13.0.3+ 1 more
- (no CPE)range: v12.0.9--v13.0.3
- (no CPE)range: v12.0.9

Patches

Vulnerability mechanics

References

github.com/frappe/frappe/commit/497ea861f481c6a3c52fe2aed9d0df1b6c99e9d7nvdPatchThird Party Advisory
www.mend.io/vulnerability-database/CVE-2022-23057nvdExploitPatchThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000