CVE-2022-23056: Frappe Erpnext

Low severity, CVSS 3.5. EPSS: 0.9% chance of exploitation in the next 30 days.

In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack.

Affected products

• Frappe Erpnext: from 13.0.1, before 13.30.0 (fixed in 13.30.0); version 13.0.0 only

Published 2022-06-22. Last modified 2026-06-17.