Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks in fields that are intended for plain text. Although JavaScript is blocked (preventing XSS), the HTML is still preserved in the generated PDF document. As a result, an attacker can inject malicious clickable links into an ERP-generated PDF. Since PDF files generated by the ERP system are generally considered trustworthy, users are highly likely to click these links, potentially enabling phishing attacks or malware delivery. This issue occurs in the Add Quality Goal' function.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
ERPNext 安全漏洞
Vulnerability Description
ERPNext是印度ERPNext公司的一套开源的企业资源计划解决方案。 ERPNext 15.88.1及之前版本存在安全漏洞，该漏洞源于未清理或移除纯文本字段中的HTML标签，可能导致钓鱼攻击或恶意软件传播。
CVSS Information
N/A
Vulnerability Type
N/A