PT-2026-7328 · Frappe · Frappe

Stolichnayer · Publicado 2026-02-10 · Atualizado 2026-02-10 · CVE-2026-25956

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 14.99.14 Frappe versions prior to 15.94.0

Description A crafted malicious signup URL for a Frappe site could lead to an open redirect or reflected cross-site scripting (XSS), depending on the crafted payload, when a user signs up. The issue occurs when a user accesses a specially designed URL.

Recommendations Update to Frappe version 14.99.14 or later. Update to Frappe version 15.94.0 or later.

Exploit

Correção

Open Redirect

XSS

Enumeração de Fraquezas

CWE-601

CWE-79

Identificadores relacionados

CVE-2026-25956

GHSA-7M8V-G2PR-H2F7

Produtos afetados

Frappe

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25956.json · Exploit
• https://github.com/frappe/frappe/commit/22cac9dd240dc1fa00d4bab7e3887b70faf22bd1 · Correção
• https://github.com/frappe/frappe/security/advisories/GHSA-7m8v-g2pr-h2f7 · Aviso do Fabricante
• https://t.me/CVEtracker/44317 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2021367871843033329 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-25956 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-25956 · Aviso do Fabricante