CVE-2025-71430 in Frappe
Summary
by MITRE • 10/13/2026
Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper neutralization. Authenticated attackers can set a crafted user name that executes arbitrary JavaScript in the browsers of other users who view the leaderboard.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw resides within the Frappe framework, specifically affecting versions prior to 14.99.10 and version series 15.x prior to release 15.91.1. This vulnerability is classified as a stored cross-site scripting issue located in the leaderboard page functionality of the application. The core technical deficiency involves the improper neutralization or encoding of user-supplied data when it is rendered for display. Specifically, usernames provided by users are inserted into the HTML content of the leaderboard without adequate sanitization checks that would strip out malicious script tags or encode special characters such as angle brackets and quotes. This lack of input validation allows an attacker to inject executable JavaScript code directly into the stored user profile data rather than merely in a transient request parameter, which distinguishes this from reflected XSS attacks where the payload is only executed if the victim clicks a specially crafted link.
From an operational perspective, this vulnerability poses significant risks because it requires authentication for exploitation but does not require specific privileges beyond having access to create or modify user profiles. An authenticated attacker can register with a malicious username containing embedded JavaScript payloads and then wait for other legitimate users to view the leaderboard page. When these victims load the page, their browsers will parse and execute the injected script within the context of the application domain. This execution environment grants the malicious code access to session cookies, local storage data, and potentially sensitive user information displayed on the same pages. The attacker can leverage this capability to perform actions such as account hijacking by stealing authentication tokens, conducting phishing attacks against other users by manipulating page content dynamically, or exfiltrating confidential business intelligence visible within the leaderboard context.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism here involves stored persistence where the malicious payload is saved on the target server and served to other users later. In terms of tactical mapping within the MITRE ATT&CK framework for enterprise security, this behavior corresponds to T1059 Command and Control via Application Layer Protocol or more specifically techniques related to Client-Side Scripting Injection such as T1189 Drive-by Compromise if used in conjunction with other exploits, but primarily it facilitates Account Manipulation through credential theft. The persistence of the payload means that even after the initial attack vector is discovered, previously stored malicious usernames will continue to compromise new visitors until the data is cleaned or the vulnerability is patched.
Mitigation strategies must prioritize immediate patching by upgrading the Frappe framework to version 14.99.10 or later for the legacy branch and version 15.91.1 or later for the current development line, as these releases contain fixes for this input validation deficiency. In addition to software updates, organizations should implement strict output encoding practices within their custom applications built on Frappe, ensuring that all dynamic content derived from user inputs is encoded according to HTML entity standards before rendering in the DOM. Deploying a Web Application Firewall with rules capable of detecting and blocking common XSS payloads can provide an additional layer of defense-in-depth while patching efforts are underway. Furthermore, implementing Content Security Policy headers can restrict the execution of inline scripts, thereby mitigating the impact even if some malicious content manages to bypass input validation filters. Regular security audits focusing on data flow from user inputs to HTML output generation are essential to prevent similar vulnerabilities in future development cycles.