EUVD-2026-98001

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the...

CVE-2026-109604

Frappe ERPNext versions before 15.112.0 and 16.x before 16.23.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The issue stems from a tool view that interpolates stored record names into markup without proper escaping. An authenticated user with permissions to create records...