CVE-2026-38432

Published: May 5, 2026Modified: Jul 24, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email Template engine. An attacker with permission to create or edit email templates can inject malicious JavaScript code that are executed on the victim's browser when the template is applied.

Affected (1)

Products: Frappe: Erpnext

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Frappe Erpnext	Up to 15.103.1

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://c0wking.hashnode.dev/stored-xss-in-erpnext-frappe-email-template-engine

Source: cve@mitre.org

ExploitThird Party Advisory

https://c0wking.hashnode.dev/stored-xss-in-erpnext-frappe-email-template-engine

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

Timeline

No history available yet.