CVE-2026-109657 Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name

Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script through a record name rendered without escaping. Attackers can set a malicious record name so the script runs in the browser of any colleague who opens the...

CVE-2026-109653 Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record field that executes in the browser of any...

CVE-2026-109653

Frappe ERPNext versions before 15.119.0 and 16.x before 16.31.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is that record fields are rendered into an HTML attribute context without proper escaping. A low-privilege user can inject a malicious payload into a...

CVE-2026-109653 Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record field that executes in the browser of any...

CVE-2026-109633

Frappe ERPNext versions prior to 15.119.1 and 16.x before 16.32.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the lack of input neutralization for content submitted through a public-facing booking page . An unauthenticated attacker can submit crafted content that...

CVE-2026-109633 Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can submit crafted content that is rendered as raw HTML in a...

CVE-2026-109633 Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can submit crafted content that is rendered as raw HTML in a...

CVE-2026-109612

Frappe ERPNext versions before 15.120.0 and 16.x before 16.33.0 are vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the report view. The root cause is the interpolation of stored record names into markup without proper escaping. Authenticated users with record creation permissi...

CVE-2026-109612 Frappe ERPNext before 15.120.0 Stored XSS via Report View

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup without escaping. Authenticated users able to create records can store crafted record names that execute script in the...

CVE-2026-109604 ERPNext before 15.112.0 Stored XSS via Tool View Record Names

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the...

CVE-2026-109602

The Frappe framework (versions before 15.118.0 and 16.x before 16.31.0 ) is vulnerable to a stored cross-site scripting (XSS) flaw within the dashboard chart filters. The root cause is that jQuery renders entered filter values as rich text without sufficient sanitization. This allows authenticate...

CVE-2026-109602 Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters

Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart filters because jQuery renders entered filter values as rich text. Authenticated attackers can store malicious filter values that execute scripts in the browsers of users who vie...

CVE-2026-109602 Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters

Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart filters because jQuery renders entered filter values as rich text. Authenticated attackers can store malicious filter values that execute scripts in the browsers of users who vie...

CVE-2026-109597

Hugo versions v0.60.0 before v0.167.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The issue occurs when Markdown content authors provide crafted explicit heading IDs, allowing them to break out of unescaped href attributes in the .TableOfContents or .Fragments.ToHTML output. This ...

CVE-2026-109597 Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs

Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject...

CVE-2026-109597 Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs

Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject...

CVE-2025-71430

The Frappe framework versions prior to 14.99.10 and 15.x before 15.91.1 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the failure to properly neutralize user names when rendered on the leaderboard page . An authenticated attacker can set a malicious username to exe...

CVE-2025-71430 Frappe before 15.91.1 Stored XSS via Leaderboard User Names

Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper neutralization. Authenticated attackers can set a crafted user name that executes arbitrary JavaScript in the browsers of othe...

DEBIAN-CVE-2026-104140

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 OGC API Features HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer...

CVE-2026-104140

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 OGC API Features HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer...