CVE-2025-65267

Katalog CVE

CVSS 9.0 · Critical EPSS 0,35%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada frappe erpnext, frappe. Skor CVSS 3.1 9.0 (Critical) menurut CISA ADP.

Deskripsi (NVD)

In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payload executes when an administrator clicks the image link to view the avatar, resulting in stored cross-site scripting (XSS). Successful exploitation may lead to account takeover, privilege escalation, or full compromise of the affected ERPNext instance.

Rincian

Terbit di NVD

3 Desember 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.0 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/PhDg1410/CVE/tree/main/CVE-2025-65267 advisory pihak ketiga
• https://github.com/frappe/erpnext product
• https://github.com/frappe/frappe product