PT-2026-111075

CVE-2026-109662

Published

2026-10-12

Updated

2026-10-12

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.112.0 Frappe ERPNext versions 16.x prior to 16.23.0

Description A stored cross-site scripting issue exists in a public portal form that allows unauthenticated submissions. The system stores content without sufficient neutralization, allowing unauthenticated attackers to submit crafted markup. This markup executes within the browser sessions of staff members who review the stored record.

Recommendations Update to version 15.112.0 or later. Update to version 16.23.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Diptanilsaha

Muztahidultanim

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')