PT-2026-111086

CVE-2026-109673

Published

2026-10-12

Updated

2026-10-12

Description by

CVSS 4.0

8.5

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.103.0 Frappe ERPNext versions 16.x prior to 16.12.0

Description A stored cross-site scripting issue exists because record names are not properly neutralized when rendered on dashboards, tools, and portals. Authenticated attackers can create malicious record names to execute scripts in the browsers of other users, which may lead to data access, data modification, and token theft, particularly targeting privileged users.

Recommendations Update to version 15.103.0 or later. Update to version 16.12.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Diptanilsaha

Odgrso

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')