CVE-2023-54408
Last modified
CVE-2023-54408 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in pages. Attackers can submit crafted HTML that bypasses the insufficient escaping and is rendered in the browsers of users who view it, enabling cross-site scripting.. EPSS estimates a 0.20% chance of exploitation in the next 30 days.
Description
Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in pages. Attackers can submit crafted HTML that bypasses the insufficient escaping and is rendered in the browsers of users who view it, enabling cross-site scripting.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2023-54408?
How severe is CVE-2023-54408?
How do I fix CVE-2023-54408?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-54402iDocView contains a server-side request forgery vulnerabilit…7.5
- CVE-2023-54403Yonyou U8 CRM before V16.5 and V18 contains an arbitrary fil…7.5
- CVE-2023-54404Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2023-54405H3C CVM, the Cloud Virtualization Management component of th…9.8
- CVE-2023-54406Frappe before 14.59.0 and 15.x before 15.5.0 contains a sand…4.9
- CVE-2023-54407Frappe 14.x before 14.45.0 contains an information disclosur…4.9
- CVE-2023-54409Frappe before 13.46.1 and 14.x before 14.20.0 contains a cro…4.8
- CVE-2023-5441NULL Pointer Dereference in GitHub repository vim/vim prior …5.5
- CVE-2023-54410Frappe before 13.22.0 contains an improper authorization vul…4.3
- CVE-2023-54411Frappe framework before 13.32.0 uses weak authentication for…5.9
- CVE-2023-54412Frappe before 13.46.3 and 14.x before 14.21.1 contains an im…6.5
- CVE-2023-54413WPML Multilingual CMS plugin for WordPress before 4.6.1 cont…6.1
Are you affected by CVE-2023-54408?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST