CVE-2025-68928 — Frappe CRM vulnerable to authenticated XSS via website field
Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, which were not saniti…
Published: 2025-12-29 · CVSS: 5.4 · CVSS 3.1
Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, which were not sanitized, causing cross-site scripting. Version 1.56.2 fixes the issue. No known workarounds are available.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7