CVE-2026-109604

Frappe ERPNext versions before 15.112.0 and 16.x before 16.23.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The issue stems from a tool view that interpolates stored record names into markup without proper escaping. An authenticated user with permissions to create records...

CVE-2026-109604 ERPNext before 15.112.0 Stored XSS via Tool View Record Names

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the...

CVE-2026-109604 ERPNext before 15.112.0 Stored XSS via Tool View Record Names

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the...

CVE-2026-109602 Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters

Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart filters because jQuery renders entered filter values as rich text. Authenticated attackers can store malicious filter values that execute scripts in the browsers of users who vie...

CVE-2026-109602 Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters

Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart filters because jQuery renders entered filter values as rich text. Authenticated attackers can store malicious filter values that execute scripts in the browsers of users who vie...

CVE-2026-109602

The Frappe framework (versions before 15.118.0 and 16.x before 16.31.0 ) is vulnerable to a stored cross-site scripting (XSS) flaw within the dashboard chart filters. The root cause is that jQuery renders entered filter values as rich text without sufficient sanitization. This allows authenticate...

CVE-2026-109597 Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs

Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject...

CVE-2026-109597

Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject...

CVE-2026-109597

Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject...

CVE-2026-109597 Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs

Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject...

CVE-2026-109597

Hugo versions v0.60.0 before v0.167.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The issue occurs when Markdown content authors provide crafted explicit heading IDs, allowing them to break out of unescaped href attributes in the .TableOfContents or .Fragments.ToHTML output. This ...

CVE-2026-109597 Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs

Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject...

CVE-2025-71432 Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover

Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary JavaScript to execute in authenticated sessions. Remote attackers can lure a logged-in user into opening a crafted UR...

CVE-2025-71432 Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover

Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary JavaScript to execute in authenticated sessions. Remote attackers can lure a logged-in user into opening a crafted UR...

CVE-2025-71432

Frappe ERPNext versions before 14.92.1 and 15.x before 15.83.0 are vulnerable to a reflected cross-site scripting (XSS) vulnerability. The root cause is missing input validation on a specific page, which enables the execution of arbitrary JavaScript within authenticated user sessions. A remote at...

CVE-2025-71430

The Frappe framework versions prior to 14.99.10 and 15.x before 15.91.1 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the failure to properly neutralize user names when rendered on the leaderboard page . An authenticated attacker can set a malicious username to exe...

CVE-2025-71430 Frappe before 15.91.1 Stored XSS via Leaderboard User Names

Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper neutralization. Authenticated attackers can set a crafted user name that executes arbitrary JavaScript in the browsers of othe...

CVE-2025-71430 Frappe before 15.91.1 Stored XSS via Leaderboard User Names

Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper neutralization. Authenticated attackers can set a crafted user name that executes arbitrary JavaScript in the browsers of othe...

CVE-2024-58391 Frappe before 15.4.0 XSS via Printview Parameters

Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not escaped before being rendered. Remote attackers can craft a malicious printview URL that, when visited by a victim, injects HTML and executes script in the...

CVE-2024-58391 Frappe before 15.4.0 XSS via Printview Parameters

Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not escaped before being rendered. Remote attackers can craft a malicious printview URL that, when visited by a victim, injects HTML and executes script in the...