CVE-2025-68928

MEDIUM

Frappe CRM vulnerable to authenticated XSS via website field

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-68928 has a selected CVSS score of 5.4 (medium).

Description

Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, which were not sanitized, causing cross-site scripting. Version 1.56.2 fixes the issue. No known workarounds are available.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 29, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

crm

Browse frappe / crm
CVE List< 1.56.2affected

References

3