CVE-2023-46127 — Frappe vulnerable to HTML injection by any Desk user
Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Frappe user with desk access …
Published: 2023-10-23 · CVSS: 5.4 · CVSS 3.1
Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Frappe user with desk access could create documents containing HTML payloads allowing HTML Injection. This vulnerability has been patched in version 14.49.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7