CVE-2025-71432: Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover
Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary JavaScript to execute in authenticated sessions. Remote attackers can lure a logged-in user into opening a crafted URL to run injected script and take over the victim's account.
Affected Software
Event History
Frequently Asked Questions
Which ERPNext versions are affected?
ERPNext versions before 14.92.1 are affected, as are 15.x versions before 15.83.0.
What does an attacker need to exploit this issue?
An attacker can operate remotely without prior privileges, but must persuade a logged-in user to open a crafted URL. The injected JavaScript then executes in that user's authenticated session.
Are users at risk without interacting with an attacker-controlled link?
The available information indicates user interaction is required: a logged-in user must open the crafted URL. The issue is reflected XSS rather than an attack described as executing automatically.
What is the likely impact if exploitation succeeds?
The attacker can execute arbitrary JavaScript in the victim's authenticated ERPNext session and may take over that user's account. Confidentiality and integrity impacts are rated high, while no availability impact is specified.