Description
Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary JavaScript to execute in authenticated sessions. Remote attackers can lure a logged-in user into opening a crafted URL to run injected script and take over the victim's account.
Published: 2026-10-12
Score: 8.6 High
EPSS: n/a
KEV: No
Impact: Account Takeover via Reflected XSS in ERPNext
Action: Patch
AI Analysis

Impact

The vulnerability is a reflected cross‑site scripting flaw caused by missing input validation on a page in Frappe ERPNext. The flaw allows an attacker to inject arbitrary JavaScript into responses that an authenticated user receives. If a user visits a maliciously crafted link, the script runs with the user’s browser credentials and can hijack the account, leading to loss of confidentiality and integrity.

Affected Systems

The flaw affects any installation of the ERPNext product from Frappe, specifically versions earlier than 14.92.1 and the entire 15.x series before 15.83.0.

Risk and Exploitability

The weakness is classified as CWE‑79 and has a CVSS score of 8.6, indicating high severity. EPSS data is unavailable, and the issue is not listed in the CISA KEV catalog. Exploitation requires a remote attacker to convince a logged‑in user to open a crafted URL; the user’s session cookie allows the script to run with the user’s privileges, enabling account takeover. The attack vector is inferred to be remote via a web link that the user opens, and it succeeds only in authenticated sessions.

Generated by OpenCVE AI on October 12, 2026 at 23:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade ERPNext to version 15.83.0 or later to receive the input‑validation fix
  • Test the configuration by attempting to load a page containing a known XSS payload and verify that the script is not echoed back
  • Educate users to avoid opening unexpected URLs while logged into ERPNext to reduce the chance of successful phishing attacks

Generated by OpenCVE AI on October 12, 2026 at 23:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Description Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary JavaScript to execute in authenticated sessions. Remote attackers can lure a logged-in user into opening a crafted URL to run injected script and take over the victim's account.
Title Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover
First Time appeared Frappe
Frappe erpnext
Weaknesses CWE-79
CPEs cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*
Vendors & Products Frappe
Frappe erpnext
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Frappe Erpnext
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-12T22:21:47.881Z

Reserved: 2026-10-12T21:08:47.548Z

Link: CVE-2025-71432

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-12T23:17:19.297

Modified: 2026-10-12T23:17:19.413

Link: CVE-2025-71432

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T23:30:18Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')