ERPNext 11.1.47 allows blog?blog_category= Frame Injection.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-20511.json"