{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/erpnext--15.121.0-16.x--16.34.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2025-71432"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ERPNext (\u003c 14.92.1, \u003c 15.83.0)","ERPNext (\u003c 15.121.0, 16.x \u003c 16.34.0)","ERPNext (\u003c 16.22.0)","ERPNext (\u003c 15.119.1, 16.x \u003c 16.32.0)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","authorization-bypass","erpnext","server-side-template-injection","web-application-vulnerability"],"_cs_type":"advisory","_cs_vendors":["Frappe"],"content_html":"\u003cp\u003eFrappe ERPNext versions prior to 14.92.1 and 15.x before 15.83.0 contain a reflected cross-site scripting (XSS) vulnerability. The issue stems from insufficient input validation on a specific web page within the ERPNext application. This flaw allows remote, unauthenticated attackers to craft malicious URLs containing injected JavaScript. If an authenticated user is coerced into interacting with these crafted URLs, the injected script executes within the victim's browser session. Successful exploitation enables unauthorized actions on behalf of the victim, potentially leading to full account takeover, session token theft, or data exfiltration.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability poses a high risk to organizations utilizing ERPNext for business operations. If exploited, an attacker could gain administrative control over an affected user's account, access sensitive business data, or perform unauthorized transactions within the ERP system. Because this is a reflected XSS attack, the scope is limited to users that can be social-engineered into clicking the malicious link.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to Frappe ERPNext version 14.92.1 or later, or 15.83.0 or later to patch CVE-2025-71432.\u003c/li\u003e\n\u003cli\u003eImplement Content Security Policy (CSP) headers to restrict the execution of unauthorized inline scripts and mitigate the impact of potential XSS vulnerabilities.\u003c/li\u003e\n\u003cli\u003eEnsure users are educated on the risks of clicking unsolicited or suspicious links, especially when logged into critical business applications.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T00:32:17Z","date_published":"2026-10-13T00:31:05Z","id":"https://feed.craftedsignal.io/briefs/2026-10-frappe-xss/","summary":"Frappe ERPNext versions before 14.92.1 and 15.x before 15.83.0 are susceptible to reflected XSS, allowing unauthenticated attackers to execute arbitrary JavaScript in authenticated sessions.","title":"Reflected Cross-Site Scripting Vulnerability in Frappe ERPNext","url":"https://feed.craftedsignal.io/briefs/2026-10-frappe-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - ERPNext (\u003c 15.121.0, 16.x \u003c 16.34.0)","version":"https://jsonfeed.org/version/1.1"}