The vulnerability is a stored XSS that arises from unsanitized record names displayed in dashboards, tools, and portals. An attacker who is authenticated can create a record with a name containing JavaScript, which will be rendered when other users view the record, causing script execution in their browsers. This allows the attacker to read or modify data, steal session tokens, and potentially gain privileged access if the victim is an administrator.

The flaw exists in Frappe ERPNext releases before 15.103.0 and in the 16.x branch before version 16.12.0. Systems running those versions and using the affected dashboards or portals are at risk.

The CVSS score of 8.5 indicates high severity. No EPSS score is available, so the likelihood is not quantified, but the absence of a KEV listing suggests no widespread active exploitation yet. However, because the attack requires authentication, attackers may still target privileged users. The vulnerability can be exploited by simply creating a malicious record name, which requires no special privileges beyond being a valid user. The affected dashboards display the names without escaping, allowing script execution.