Medium severity4.3NVD Advisory· Published Oct 12, 2026· Updated Oct 12, 2026

CVE-2024-58391

Description

Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not escaped before being rendered. Remote attackers can craft a malicious printview URL that, when visited by a victim, injects HTML and executes script in the victim's browser session.

Affected products

Frappe/Frappellm-fuzzy
Range: <14.58.0, <15.4.0

Patches

Vulnerability mechanics

References

github.com/frappe/frappe/security/advisories/GHSA-v248-pv3c-jvgwnvd
www.vulncheck.com/advisories/frappe-before-15.4.0-xss-via-printview-parametersnvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000