Back to CVE List

CVE-2026-42840

Vulnerability Description

An authenticated user can persist arbitrary HTML/JavaScript in the email_id or mobile_no fields of a Customer record and trigger unescaped rendering in the Point of Sale (POS) interface for every operator who selects that customer.
This issue affects ERPNext: 16.16.0.

Vulnerability Details

Published Date
Last Modified
CWE ID
CWE-79
Source
NVD
Vendor
Frappe
Product
ERPNext

External References

Discussion (0)

Add Comment

No comments yet. Be the first!