CVE-2026-38432

6.1 Moyenne

Publiée le 05/05/2026 à 19:17 · Modifiée le 24/07/2026 à 23:10 · Analysée par le NVD · Source : cve@mitre.org

Description

ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email Template engine. An attacker with permission to create or edit email templates can inject malicious JavaScript code that are executed on the victim's browser when the template is applied.

Traduire en français

Produits concernés

Frappe erpnext

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.1 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-79

Références

https://c0wking.hashnode.dev/stored-xss-in-erpnext-frappe-email-template-engine ExploitThird Party Advisory
https://c0wking.hashnode.dev/stored-xss-in-erpnext-frappe-email-template-engine ExploitThird Party Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories