https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-15T02:28:01.984903+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-109633 CVE-2026-109633 — Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page 2026-10-15T02:28:01.987209+00:00

Affected: frappe erpnext

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can submit crafted content that is rendered as raw HTML in a privileged user's session, executing script to act as that user and take over the account.