{"id":"CVE-2019-20518","details":"ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI.","modified":"2026-08-07T15:18:57.481165Z","published":"2020-03-19T18:15:15.507Z","references":[{"type":"EVIDENCE","url":"https://www.netsparker.com/web-applications-advisories/ns-19-017-cross-site-scripting-in-erpnext/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/frappe/erpnext","events":[{"introduced":"1866cebd14911660fdfc2e82225ecd5841527d57"},{"last_affected":"1866cebd14911660fdfc2e82225ecd5841527d57"}],"database_specific":{"cpe":"cpe:2.3:a:frappe:erpnext:11.1.47:*:*:*:*:*:*:*","extracted_events":[{"introduced":"11.1.47"},{"last_affected":"11.1.47"}],"source":"CPE_STRING"}}],"versions":["11.1.47","v11.1.47"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-20518.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}