{"id":"CVE-2023-54409","url":"https://www.cyber-defence.io/tools/cve/CVE-2023-54409","generatedAt":"2026-10-28T01:50:43.068Z","title":"Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input.","description":"Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input. Authenticated attackers can supply crafted HTML that is insufficiently sanitized by html2text, executing scripts in the browsers of users who view the rendered content.","published":"2026-10-12T23:17:17.000Z","lastModified":"2026-10-13T14:17:17.000Z","status":"Deferred","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":5.9,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-80"],"affected":[],"epss":{"score":0.00224,"percentile":0.12858,"date":"2026-10-26","history":[{"date":"2026-10-13","score":0.00224,"percentile":0.11989}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.22%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-12T23:17:17.000Z","detail":{"score":"5.9","severity":"MEDIUM","publishedAt":"2026-10-12T23:17:17.440Z"},"summary":"New CVE, medium severity (CVSS 5.9)."}],"references":[{"url":"https://github.com/frappe/frappe/security/advisories/GHSA-wp7j-3w22-93j6","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/frappe-before-13.46.1-xss-via-html2text-weak-sanitization","source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-54409","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}