Cross-Site Scripting Vulnerability in Frappe ERPNext by Frappe Technologies
CVE-2022-28598
6.1MEDIUM
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2022-28598?
Frappe ERPNext version 12.29.0 contains a vulnerability that allows attackers to exploit weaknesses in user input handling. The software fails to properly sanitize or neutralize user-provided input before rendering it on web pages. This can allow malicious content to be injected and subsequently executed in the browsers of other users, leading to potential data theft, session hijacking, or further attacks against unsuspecting users. The vulnerability underscores the importance of robust input validation and output encoding in web applications.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.