CVE-2019-20517: Frappe Erpnext

Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days.

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI.

Affected products

• Frappe Erpnext: version 11.1.47 only

Published 2020-03-19. Last modified 2026-06-17.