CVE-2025-71430 — Frappe before 15.91.1 Stored XSS via Leaderboard User Names
Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper neutra…
Published: 2026-10-12 · CVSS: 5.1 · CVSS 4.0
Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper neutralization. Authenticated attackers can set a crafted user name that executes arbitrary JavaScript in the browsers of other users who view the leaderboard.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7