CVE-2025-68928
Stored Cross-Site Scripting in Frappe CRM Website Field
Publication date: 2025-12-29
Last updated on: 2025-12-29
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| frappe | frappe_crm | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Frappe CRM prior to version 1.56.2 allows authenticated users to set crafted URLs in a website field that are not properly sanitized, leading to a cross-site scripting (XSS) issue. This means malicious scripts can be injected and executed in the context of the application.
How can this vulnerability impact me? :
The vulnerability can lead to cross-site scripting attacks, which may allow attackers to execute malicious scripts in users' browsers, potentially leading to theft of sensitive information, session hijacking, or other malicious actions within the application context.
What immediate steps should I take to mitigate this vulnerability?
Upgrade Frappe CRM to version 1.56.2 or later, as this version fixes the cross-site scripting vulnerability. No known workarounds are available.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if your frappe CRM instance is running a version prior to 1.56.2, as those versions allow authenticated users to inject crafted URLs in the website field without proper sanitization. To detect exploitation attempts, you can monitor HTTP requests for suspicious or crafted URLs in the website field submitted by authenticated users. Since the vulnerability involves cross-site scripting via crafted URLs, inspecting logs or database entries for website fields containing unusual URL schemes or JavaScript payloads can help. There are no specific commands provided in the resources, but general approaches include querying the database for website fields containing suspicious patterns or using web application firewall (WAF) rules to detect malicious URL inputs. Upgrading to version 1.56.2 or later is the recommended mitigation. [1, 2]