CVE-2025-71432: Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover

Q: Which ERPNext versions are affected?

ERPNext versions before 14.92.1 are affected, as are 15.x versions before 15.83.0.

Q: What does an attacker need to exploit this issue?

An attacker can operate remotely without prior privileges, but must persuade a logged-in user to open a crafted URL. The injected JavaScript then executes in that user's authenticated session.

Q: Are users at risk without interacting with an attacker-controlled link?

The available information indicates user interaction is required: a logged-in user must open the crafted URL. The issue is reflected XSS rather than an attack described as executing automatically.

Q: What is the likely impact if exploitation succeeds?

The attacker can execute arbitrary JavaScript in the victim's authenticated ERPNext session and may take over that user's account. Confidentiality and integrity impacts are rated high, while no availability impact is specified.

Published Oct 12, 2026

Updated

Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary JavaScript to execute in authenticated sessions. Remote attackers can lure a logged-in user into opening a crafted URL to run injected script and take over the victim's account.

Affected Software

1 affected component

Frappe ERPNext<14.92.1, <15.83.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:21 PM

Data Sourced

via MITRE·10:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which ERPNext versions are affected?

ERPNext versions before 14.92.1 are affected, as are 15.x versions before 15.83.0.

What does an attacker need to exploit this issue?

An attacker can operate remotely without prior privileges, but must persuade a logged-in user to open a crafted URL. The injected JavaScript then executes in that user's authenticated session.

Are users at risk without interacting with an attacker-controlled link?

The available information indicates user interaction is required: a logged-in user must open the crafted URL. The issue is reflected XSS rather than an attack described as executing automatically.

What is the likely impact if exploitation succeeds?

The attacker can execute arbitrary JavaScript in the victim's authenticated ERPNext session and may take over that user's account. Confidentiality and integrity impacts are rated high, while no availability impact is specified.

CVE-2025-71432: Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover

Affected Software

Event History

Frequently Asked Questions

Which ERPNext versions are affected?

What does an attacker need to exploit this issue?

Are users at risk without interacting with an attacker-controlled link?

What is the likely impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which ERPNext versions are affected?

What does an attacker need to exploit this issue?

Are users at risk without interacting with an attacker-controlled link?

What is the likely impact if exploitation succeeds?