PT-2026-5952 · Frappe+1 · Erpnext

Published 2026-02-03 · Updated 2026-02-03 · CVE-2025-65924

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ERPNext versions through 15.88.1

Description The software does not properly remove certain HTML tags, specifically <a> hyperlinks, in fields designed for plain text input. While JavaScript execution is blocked, the HTML is retained within generated PDF documents. This allows an attacker to inject malicious, clickable links into ERP-generated PDFs. Because PDFs from the ERP system are generally considered trustworthy, users are likely to click these links, potentially leading to phishing attacks or malware delivery. The issue is present in the Add Quality Goal function.

Recommendations Versions prior to 15.88.1 should be updated.

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2025-65924

Affected Products

Erpnext

References · 3

• https://osv.dev/vulnerability/CVE-2025-65924 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65924 · Security Note
• ❌ https://github.com/frappe/frappe_docker.git · Note, Deleted