CVE-2026-109604
7.3HighPublished 12 Oct 2026 · NVD status: Deferred
7.3High
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-79
The AI triage for this one isn't ready yet. Check back in a few minutes; the full NVD record is below in the meantime.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Ad · In-content banner
NVD description
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the session of any user who later opens that tool.