CVE-2025-71432 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary JavaScript to execute in authenticated sessions. Remote attackers can lure a logged-in user into opening a crafted URL to run injected script and take over the victim's account.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw resides within Frappe ERPNext versions prior to 14.92.1 and 15.x prior to 15.83.0, representing a critical reflected cross-site scripting vulnerability that stems from insufficient input validation mechanisms on specific application pages. This technical deficiency allows remote attackers to inject arbitrary JavaScript code into HTTP responses without proper sanitization or encoding of user-supplied data. The core issue lies in the failure to validate and escape special characters within query parameters or URL fragments before they are rendered back to the client browser, creating a direct pathway for malicious script execution during the reflection phase of the request-response cycle.
From an operational perspective, this vulnerability poses a severe risk because it targets authenticated sessions rather than unauthenticated users. An attacker can craft a deceptive URL containing the malicious payload and lure a legitimate user into accessing it through social engineering tactics such as phishing emails or compromised links. Once the victim opens the crafted link while logged into their ERPNext account, the browser executes the injected JavaScript within the context of that authenticated session. This execution environment grants the script full access to sensitive application data, cookies, and local storage associated with the user's privileges, effectively bypassing standard security controls designed for unauthenticated threats.
The impact of this vulnerability extends beyond simple defacement or minor disruption, as it facilitates complete account takeover scenarios. By leveraging JavaScript capabilities such as document.cookie extraction or XMLHttpRequest manipulation, an attacker can steal session tokens to hijack the victim's identity remotely without needing their password. Furthermore, the script can perform actions on behalf of the user, including modifying financial records, exporting sensitive business intelligence, or altering system configurations, thereby compromising data integrity and confidentiality within the enterprise resource planning environment. This aligns with Common Weakness Enumeration identifier CWE-79 for Improper Neutralization of Input During Web Page Generation and is categorized under MITRE ATT&CK technique T1059 as Command and Scripting Interpreter via Browser-based Execution.
To mitigate this risk, organizations must immediately upgrade to Frappe ERPNext version 14.92.1 or later, or version 15.83.0 for the newer branch, where these input validation gaps have been addressed by developers through rigorous sanitization protocols and output encoding practices. In addition to patching, administrators should implement strict Content Security Policy headers that restrict script execution sources and disable inline scripts where possible to limit the impact of any successful injection attempts. User awareness training regarding phishing indicators is also recommended as a secondary defense layer to reduce the likelihood of users interacting with maliciously crafted URLs designed to exploit this specific reflection-based flaw.