CVE-2022-23058: Frappe Erpnext

Low severity, CVSS 3.5. EPSS: 0.9% chance of exploitation in the next 30 days.

ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover.

Affected products

• Frappe Erpnext: from 12.0.9, before 13.1.0 (fixed in 13.1.0)

Published 2022-06-22. Last modified 2026-06-17.