CVE-2023-54409
Last modified
CVE-2023-54409 is a medium-severity vulnerability rated 4.8/10 on the CVSS scale. Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input. Authenticated attackers can supply crafted HTML that is insufficiently sanitized by html2text, executing scripts in the browsers of users who view the rendered content..
Description
Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input. Authenticated attackers can supply crafted HTML that is insufficiently sanitized by html2text, executing scripts in the browsers of users who view the rendered content.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2023-54409?
How severe is CVE-2023-54409?
How do I fix CVE-2023-54409?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-54403Yonyou U8 CRM before V16.5 and V18 contains an arbitrary fil…7.5
- CVE-2023-54404Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2023-54405H3C CVM, the Cloud Virtualization Management component of th…9.8
- CVE-2023-54406Frappe before 14.59.0 and 15.x before 15.5.0 contains a sand…4.9
- CVE-2023-54407Frappe 14.x before 14.45.0 contains an information disclosur…4.9
- CVE-2023-54408Frappe before 13.52.0 and 14.x before 14.31.0 contains an HT…6.1
- CVE-2023-5441NULL Pointer Dereference in GitHub repository vim/vim prior …5.5
- CVE-2023-54410Frappe before 13.22.0 contains an improper authorization vul…4.3
- CVE-2023-54411Frappe framework before 13.32.0 uses weak authentication for…5.9
- CVE-2023-54412Frappe before 13.46.3 and 14.x before 14.21.1 contains an im…6.5
- CVE-2023-54413WPML Multilingual CMS plugin for WordPress before 4.6.1 cont…6.1
- CVE-2023-5442Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
Are you affected by CVE-2023-54409?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST