Press’s login page accepts a redirect parameter that is reflected back into the response without proper sanitization, enabling attackers to inject JavaScript. If a victim clicks a malicious link containing a crafted redirect, the injected script runs in the user’s browser, potentially allowing cookie theft, defacement, or phishing attacks. The CVSS score of 1.3 indicates a low overall severity, but the vulnerability could be abused if users are tricked into following a malicious redirect.

The Frappe Press application, which powers Frappe Cloud’s infrastructure, subscription, and SaaS services, is affected. No version detail is provided, so any deployment of Press that includes the vulnerable login redirect code is potentially impacted.

The CVSS score of 1.3 and an EPSS below 1% show that the likelihood of exploitation is very low at present, and the issue is not listed in CISA’s KEV catalog. The attack vector is inferred to be a user clicking a crafted URL that triggers the vulnerable redirect. While the exploit is possible, it requires social engineering or phishing techniques to lure a user into executing the malicious script.