Medium severity5.4NVD Advisory· Published Oct 12, 2026· Updated Oct 12, 2026
CVE-2026-109657
CVE-2026-109657
Description
Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script through a record name rendered without escaping. Attackers can set a malicious record name so the script runs in the browser of any colleague who opens the page.
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.