PT-2026-23507

CVE-2026-28436

Published

2026-03-05

Updated

2026-03-10

Description by

CVSS 3.1

7.2

High

MetricsAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 16.11.0 and 15.102.0

Description A flaw exists in Frappe that allows an attacker to inject malicious code through a crafted image URL. This can lead to Cross-Site Scripting (XSS) when a user’s avatar is displayed. The issue can be triggered for other users through website page comments.

Recommendations Update to version 16.11.0 or later. Update to version 15.102.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Tepel-Chen

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers