CVE-2025-71430
5.4MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Authenticated attackers can execute arbitrary JavaScript in the browsers of users viewing the leaderboard. The attacker needs an existing account to set a malicious user name, and the victim must visit the leaderboard page.
Root cause
The leaderboard page renders user names without sanitizing or neutralizing malicious input.
Affected systems
Frappe versions prior to 14.99.10 and 15.x versions prior to 15.91.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Fix & remediation
Upgrade Frappe to version 14.99.10, 15.91.1, or later. No interim mitigation is documented, so patching is required.
$ bench update --apps frappeAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper neutralization. Authenticated attackers can set a crafted user name that executes arbitrary JavaScript in the browsers of other users who view the leaderboard.