Unrated severityNVD Advisory· Published Jun 22, 2022· Updated Jun 17, 2026

CVE-2022-23058

Description

ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Frappe/Erpnext2 versions
cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*range: >=12.0.9,<13.1.0
- (no CPE)range: v12.0.9-v13.0.3
Frappe/Frappellm-fuzzy2 versions
v12.0.9-v13.0.3+ 1 more
- (no CPE)range: v12.0.9-v13.0.3
- (no CPE)range: v12.0.9

Patches

Vulnerability mechanics

References

github.com/frappe/frappe/commit/497ea861f481c6a3c52fe2aed9d0df1b6c99e9d7nvdPatchThird Party Advisory
www.mend.io/vulnerability-database/CVE-2022-23058nvdExploitPatchThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000