The vulnerability consists of a stored XSS flaw in the Note field of the Frappe web application framework, caused by insufficient input sanitization. When an attacker injects malicious script into a note, the script is later displayed to any users who view the note, allowing arbitrary JavaScript execution in the victim’s browser context. This can lead to data theft, session hijacking, or malicious interactions with the web application, posing a moderate impact on confidentiality, integrity, and availability of user sessions.

The flaw affects Frappe deployments running any version prior to 15.106.0 and 16.16.0. Any installation of the Frappe core framework that has not applied these patches is potentially vulnerable.

The CVSS score of 6.9 reflects a moderate severity. The EPSS score of less than 1% indicates a very low probability that exploitation is occurring or will occur soon, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through the Note input field, where an attacker can inject script payloads. The attack may require an authenticated user or the ability to create a note, but the exact prerequisites are not detailed in the advisory. The vulnerability can be exploited by any user who can add or edit notes that are subsequently rendered without proper sanitization.