Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2024-49751: Frappe Press allows self‑served HTML injection in SaaS signup
CVE-2024-49751 · published 2 years ago
Summary
The Press app used by Frappe Cloud let a person entering data during SaaS sign‑up insert HTML code that would be displayed when they later view their own account. This risk was limited to the attacker’s own view and did not impact other users. Apply the latest update that includes the fix to stop the unwanted HTML from being accepted.
Original advisory text
Frappe Press possible HTML injection through SaaS Signup inputs
Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Prior to commit 5d118a902872d7941f099ad1fb918e2421e79ccd, a user could inject HTML through SaaS signup inputs. The user who injected the unsafe HTML code would only affect themselves and would not affect other users. Commit 5d118a902872d7941f099ad1fb918e2421e79ccd patches this bug.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49751... Vendor Advisory
- https://github.com/frappe/press/security/advisories/GHSA-rf69-h96f-rf2j Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-49751 Vendor Advisory
- https://github.com/frappe/press/commit/5d118a902872d7941f099ad1fb918e2421e79ccd Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.5
High
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published23 Oct 2024
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta