PT-2026-5951 · Frappe+1 · Erpnext

Published 2026-02-03 · Updated 2026-02-11 · CVE-2025-65923

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ERPNext versions through 15.88.1

Description A Stored Cross-Site Scripting (XSS) issue exists in the CSV import mechanism when the Update Existing Records option is used. An attacker can inject malicious JavaScript code into a CSV field. This code is stored in the database and executed when a user views the affected record in the ERPNext web interface. This could allow an attacker to compromise user sessions or perform unauthorized actions. The vulnerability impacts the application's handling of data imported through CSV files, specifically during the update process.

Recommendations Versions prior to 15.88.1 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-65923

Affected Products

Erpnext

References · 4

• https://osv.dev/vulnerability/CVE-2025-65923 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65923 · Security Note
• ❌ https://github.com/frappe/frappe_docker.git · Note, Deleted
• https://t.me/cveNotify/151719 · Telegram Post