CVE-2025-68928: Frappe CRM vulnerable to authenticated XSS via website field
Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, which were not sanitized, causing cross-site scripting. Version 1.56.2 fixes the issue. No known workarounds are available.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappe CRMto a version that resolves this vulnerability.Fixed in 1.56.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68928?
CVE-2025-68928 has a critical severity rating due to its potential for cross-site scripting attacks.
How do I fix CVE-2025-68928?
To fix CVE-2025-68928, upgrade to Frappe CRM version 1.56.2 or later.
What does CVE-2025-68928 affect?
CVE-2025-68928 affects Frappe CRM versions prior to 1.56.2.
Can authenticated users exploit CVE-2025-68928?
Yes, authenticated users can exploit CVE-2025-68928 by setting crafted URLs in website fields.
Are there any workarounds for CVE-2025-68928?
No known workarounds are available for CVE-2025-68928; upgrading is the only solution.