High severity8.1NVD Advisory· Published Oct 12, 2026· Updated Oct 12, 2026

CVE-2025-71432

Description

Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary JavaScript to execute in authenticated sessions. Remote attackers can lure a logged-in user into opening a crafted URL to run injected script and take over the victim's account.

Affected products

Frappe/Erpnextllm-fuzzy
Range: <14.92.1, <15.83.0

Patches

Vulnerability mechanics

References

github.com/frappe/erpnext/security/advisories/GHSA-f74g-9wxg-j83pnvd
www.vulncheck.com/advisories/frappe-erpnext-before-15.83.0-reflected-xss-leading-to-account-takeovernvd

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000