VYPR
← All advisories
Medium severity5.4OSV Advisory· Published Dec 29, 2025· Updated Jun 17, 2026

CVE-2025-68928

CVE-2025-68928

Description

Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, which were not sanitized, causing cross-site scripting. Version 1.56.2 fixes the issue. No known workarounds are available.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Frappe/CRMOSV2 versions
    v1.0.0, v1.0.1, v1.0.2, …+ 1 more
    • (no CPE)range: v1.0.0, v1.0.1, v1.0.2, …
    • (no CPE)range: <1.56.2
  • Frappe/Frappe CRM
    cpe:2.3:a:frappe:frappe_crm:*:*:*:*:*:*:*:*
    Range: <1.56.2

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.