CVE-2026-38432
ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email Template engine. An attacker with permission to create or edit email templates can inject m…
Published: 2026-05-05 · CVSS: 6.1 · CVSS 3.1
ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email Template engine. An attacker with permission to create or edit email templates can inject malicious JavaScript code that are executed on the victim's browser when the template is applied.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7