public/js/frappe/form/footer/timeline.js in Frappe Framework 12 up to and including 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed value of" text.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
frappe frappe |