CVE-2026-109671 Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages

Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator...

CVE-2026-109670

Frappe ERPNext versions before 15.110.0 and 16.x before 16.21.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is the rendering of record names without proper escaping . An attacker with write access to item master data can inject a malicious script into a rec...

CVE-2026-109670 Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers with write access to item master data can store malicious script in a record name that executes in the browser of any...

CVE-2026-109670 Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers with write access to item master data can store malicious script in a record name that executes in the browser of any...

CVE-2026-109662 Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissions and stores content later rendered with insufficient neutralisation. Unauthenticated attackers can submit crafted markup that...

CVE-2026-109662 Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissions and stores content later rendered with insufficient neutralisation. Unauthenticated attackers can submit crafted markup that...

CVE-2026-109662

Frappe ERPNext versions before 15.112.0 and 16.x before 16.23.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists in a public portal form that accepts unauthenticated submissions and subsequently stores content that is rendered with insufficient neutralization ....

CVE-2026-109657 Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name

Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script through a record name rendered without escaping. Attackers can set a malicious record name so the script runs in the browser of any colleague who opens the...

CVE-2026-109657 Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name

Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script through a record name rendered without escaping. Attackers can set a malicious record name so the script runs in the browser of any colleague who opens the...

CVE-2026-109657

Frappe ERPNext 16.x versions prior to 16.27.0 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the rendering of a record name without proper output escaping. An attacker with edit rights can inject a malicious script into a record name; when a colleague views the page...

CVE-2026-109653 Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record field that executes in the browser of any...

CVE-2026-109653

Frappe ERPNext versions before 15.119.0 and 16.x before 16.31.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is that record fields are rendered into an HTML attribute context without proper escaping. A low-privilege user can inject a malicious payload into a...

CVE-2026-109653 Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record field that executes in the browser of any...

CVE-2026-109633

Frappe ERPNext versions prior to 15.119.1 and 16.x before 16.32.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the lack of input neutralization for content submitted through a public-facing booking page . An unauthenticated attacker can submit crafted content that...

CVE-2026-109633 Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can submit crafted content that is rendered as raw HTML in a...

CVE-2026-109633 Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can submit crafted content that is rendered as raw HTML in a...

CVE-2026-109612 Frappe ERPNext before 15.120.0 Stored XSS via Report View

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup without escaping. Authenticated users able to create records can store crafted record names that execute script in the...

CVE-2026-109612

Frappe ERPNext versions before 15.120.0 and 16.x before 16.33.0 are vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the report view. The root cause is the interpolation of stored record names into markup without proper escaping. Authenticated users with record creation permissi...

CVE-2026-109612 Frappe ERPNext before 15.120.0 Stored XSS via Report View

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup without escaping. Authenticated users able to create records can store crafted record names that execute script in the...

CVE-2026-109604

Frappe ERPNext versions before 15.112.0 and 16.x before 16.23.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The issue stems from a tool view that interpolates stored record names into markup without proper escaping. An authenticated user with permissions to create records...