CVE-2023-54408— Frappe before 14.31.0 HTML Injection via Weak Escaping
Quick assessment
Affected
frappe frappe
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Frappe 13.52.0 之前的版本以及 14.x 系列中 14.31.0 之前的版本存在一个 HTML 注入漏洞，该漏洞是由对用户提供的、在页面中渲染的内容的转义处理不足所导致的。攻击者可以提交精心构造的 HTML 内容，绕过不足的转义机制，并在查看该内容的用户浏览器中渲染，从而引发跨站脚本攻击（XSS）。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-54408
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Frappe before 14.31.0 HTML Injection via Weak Escaping
Source: CVE Program / CVE List V5
Vulnerability Description
Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in pages. Attackers can submit crafted HTML that bypasses the insufficient escaping and is rendered in the browsers of users who view it, enabling cross-site scripting.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2023-54408
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-54408
请登录查看更多情报信息。
Vendor Advisories for CVE-2023-54408 (2)
-
-
🔗 Frappe before 14.31.0 HTML Injection via Weak Escaping | Advisories | VulnCheck third-party-advisory
Same Patch Batch · frappe · 2026-10-12 · 86 CVEs total
| CVE-2026-109652 | 8.8 HIGH | Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields |
| CVE-2024-58390 | 8.8 HIGH | Frappe before 15.41.0 Privilege Escalation via Document Action |
| CVE-2026-109667 | 8.8 HIGH | Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation |
| CVE-2026-109608 | 8.8 HIGH | Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input |
| CVE-2025-71432 | 8.1 HIGH | Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover |
| CVE-2026-109633 | 8.1 HIGH | Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page |
| CVE-2026-109640 | 8.1 HIGH | Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modificatio |
| CVE-2026-109604 | 7.3 HIGH | ERPNext before 15.112.0 Stored XSS via Tool View Record Names |
| CVE-2026-109653 | 7.3 HIGH | Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover |
| CVE-2026-109671 | 7.3 HIGH | Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages |
| CVE-2026-109612 | 7.3 HIGH | Frappe ERPNext before 15.120.0 Stored XSS via Report View |
| CVE-2026-109673 | 7.3 HIGH | Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names |
| CVE-2026-109613 | 7.1 HIGH | Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modificati |
| CVE-2026-109616 | 7.1 HIGH | Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification |
| CVE-2026-109617 | 7.1 HIGH | Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints |
| CVE-2026-109627 | 6.5 MEDIUM | Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data |
| CVE-2026-109645 | 6.5 MEDIUM | Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization |
| CVE-2026-109661 | 6.5 MEDIUM | Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data |
| CVE-2026-109656 | 6.5 MEDIUM | Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access |
| CVE-2026-109672 | 6.5 MEDIUM | Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data |
Showing top 20 of 86 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: frappe
-
CVE-2026-109603
Frappe Framework before 16.17.0 Authenticated SSRF and LFI v -
CVE-2026-109602
Frappe before v16.31.0 Stored XSS via Dashboard Chart Filter -
CVE-2026-109600
Frappe before 16.31.0 Improper Access Control in Document Fo -
CVE-2026-109601
Frappe Framework before v16.30.0 Arbitrary File Read via Out -
CVE-2026-109598
Frappe before 16.33.0 Broken Authorization via send_sms Endp
Same vendor: frappe
-
CVE-2026-109675
Frappe Suite before commit 2697564 Broken Access Control in -
CVE-2026-109674
Frappe ERPNext before 16.6.0 SQL Injection via Missing Input -
CVE-2026-109673
Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record -
CVE-2026-109672
Frappe ERPNext before 15.118.0 Missing Authorization Exposes -
CVE-2026-109671
Frappe ERPNext before 15.113.0 Stored XSS via Profile Field
Same weakness: CWE-79
-
CVE-2026-92883
Improper Neutralization of Input During Web Page Generation -
CVE-2026-89117
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver En -
CVE-2026-76976
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Ap -
CVE-2026-76975
Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support -
CVE-2026-76972
Cross-Site Scripting (XSS) vulnerability in SAP Manufacturin
V. Comments for CVE-2023-54408
No comments yet