Frappe ERPNext: Reflected cross-site scripting leading to account takeover
Summary
Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting (XSS) vulnerability caused by missing input validation on a certain page. An attacker who lures a logged-in user into opening a crafted URL can run arbitrary JavaScript in the victim's authenticated session and take over the account. No privileges are required, but user interaction is needed, and the CVSS 4.0 score is 8.6 (High).
Affected
- Frappe ERPNext versions before 14.92.1
- Frappe ERPNext 15.x versions before 15.83.0
- Versions of 16.x: Unknown.
Fixed in
- Frappe ERPNext 14.92.1 (14.x branch)
- Frappe ERPNext 15.83.0 (15.x branch)
Workaround
Unknown. The GitHub security advisory states that no workarounds exist and that upgrading is required.
Exploitation
- Not known to be exploited. Sources do not list it as known exploited (KEV: No).
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- No public proof of concept was found for this CVE. A VulDB entry carries a "0-Day" label whose meaning is unclear.
Our recommendation
- Upgrade to ERPNext 14.92.1 or 15.83.0, or to the latest patched release of your branch.
- Restrict external access to ERPNext where possible.
- Warn users to avoid unexpected links while logged in to ERPNext.
- Review web server and application logs for unusual requests to the affected page.
- Check whether your ERPNext instance is reachable from the internet and prioritise it if it is below the fixed versions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-f74g-9wxg-j83p github.com
- VulnCheck Advisory: Frappe ERPNext before 15.83.0 Reflected XSS www.vulncheck.com
- OSV: CVE-2025-71432 osv.dev
- Strix: CVE-2025-71432 www.strix.ai
- Hol.org Guard: CVE-2025-71432 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:37.
Original description (NVD)
Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary JavaScript to execute in authenticated sessions. Remote attackers can lure a logged-in user into opening a crafted URL to run injected script and take over the victim's account.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.