CVE-2025-71432

Deferred Deferred - Pending Action

Reflected XSS in Frappe ERPNext

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary JavaScript to execute in authenticated sessions. Remote attackers can lure a logged-in user into opening a crafted URL to run injected script and take over the victim's account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2025-71432

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	erpnext	0
frappe	erpnext	15.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in Frappe ERPNext versions before 14.92.1 and 15.x before 15.83.0. It occurs due to missing input validation on a specific page, enabling attackers to inject arbitrary JavaScript code that executes in authenticated user sessions. Victims are tricked into opening a malicious URL, which runs the injected script and potentially allows account takeover.

Impact Analysis

If exploited, this vulnerability could allow attackers to steal session cookies, perform actions on your behalf, or take over your account. It may also enable phishing attacks, data theft, or unauthorized modifications to the ERPNext system. Users with administrative privileges are at higher risk of significant impact.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data breaches exposing personal data) and HIPAA (unauthorized access to protected health information). It undermines data integrity and confidentiality requirements, potentially resulting in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Frappe ERPNext to version 14.92.1 or later if using version 14.x, or to version 15.83.0 or later if using version 15.x. This addresses the reflected cross-site scripting vulnerability by adding proper input validation.

Hi! I’m here to help you understand CVE-2025-71432. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70