Moalali

**Name of the Vulnerable Software and Affected Versions** ERPNEXT version 15.67.0 **Description** A stored cross-site scripting (XSS) issue exists in the blog post feature. An attacker can inject a crafted payload into the content field, potentially leading to the execution of arbitrary web scripts or HTML. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Frappe Framework version 15.72.4 **Description** A SQL injection issue exists in Frappe Framework. The issue is located in the `fieldname` parameter of the `frappe.client.get value` API endpoint. A crafted script provided to the `fieldname` parameter can exploit this issue. **Recommendations** Apply a fix for Frappe Framework version 15.72.4 to address the SQL injection vulnerability in the `frappe.client.get value` API endpoint. As a temporary workaround, restrict access to the `frappe.client.get value` API endpoint or sanitize the `fieldname` parameter to prevent SQL injection attacks.

**Name of the Vulnerable Software and Affected Versions** ERPNEXT version 15.67.0 **Description** The software contains multiple SQL injection flaws in the `/api/method/frappe.desk.reportview.get` API endpoint. The `order by` and `group by` parameters are susceptible to exploitation. **Recommendations** Apply updates to address the identified SQL injection issues in the `/api/method/frappe.desk.reportview.get` endpoint. Avoid using the `order by` and `group by` parameters in the `/api/method/frappe.desk.reportview.get` endpoint until a fix is available.