CVE-2025-68928

MEDIUM

frappe_crm < 1.56.2 - Authenticated Stored Cross-Site Scripting via Website Field

Title source: llm

Description

Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, which were not sanitized, causing cross-site scripting. Version 1.56.2 fixes the issue. No known workarounds are available.

References (3)

Core 3

Core References

Vendor Advisory x_refsource_confirm

https://github.com/frappe/crm/security/advisories/GHSA-fm34-v6j7-chwc

Patch x_refsource_misc

https://github.com/frappe/crm/commit/c5766d9989131d17d954e866bfc4b8d3b23e4f10

View Patch ZIP pw:eip

Release Notes x_refsource_misc

https://github.com/frappe/crm/releases/tag/v1.56.2

Scores

CVSS v3 5.4

EPSS 0.0017

EPSS Percentile 6.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

frappe/frappe_crm < 1.56.2

Published Dec 29, 2025

Tracked Since Feb 18, 2026