PT-2026-23507 · Frappe · Frappe

Tepel-Chen · Publicado 2026-03-05 · Atualizado 2026-03-10 · CVE-2026-28436

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 16.11.0 and 15.102.0

Description A flaw exists in Frappe that allows an attacker to inject malicious code through a crafted image URL. This can lead to Cross-Site Scripting (XSS) when a user’s avatar is displayed. The issue can be triggered for other users through website page comments.

Recommendations Update to version 16.11.0 or later. Update to version 15.102.0 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-28436

GHSA-VM63-R48G-7WQH

Produtos afetados

Frappe

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28436.json · Exploit
• https://github.com/frappe/frappe/security/advisories/GHSA-vm63-r48g-7wqh · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-28436 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2029687040841830590 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-28436 · Nota de Segurança
• https://twitter.com/CVEnew/status/2030385212840935758 · Publicação no Twitter
• https://twitter.com/dailycve/status/2031172841484304597 · Publicação no Twitter