A stored cross‑site scripting flaw allows a low‑privileged user to place malicious script in a record field. When a privileged user opens that record, the script runs in their browser, potentially hijacking the session and granting the attacker full access to the account. The vulnerability stems from unsanitized rendering of data into an HTML attribute context (CWE‑79).

The affected product is ERPNext from the frappe vendor. Versions before 15.119.0 and all 16.x releases prior to 16.31.0 are impacted.

The CVSS base score of 8.5 signals significant risk, while the EPSS score is not available and the vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires only a low‑privileged account to create or edit a record containing the payload and then a privileged user to view that record, making the attack surface wide in shared environments. The stored nature of the payload ensures it can be reused across sessions until patched.