CVE-2025-68928CWE-79cross-site-scripting

CVE-2025-68928

Medium · published December 29, 2025

CVSS v3.1

5.4

EPSS

Percentile

10.1

In the wild

Unconfirmed

What it is

Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, which were not sanitized, causing cross-site scripting. Version 1.56.2 fixes the issue. No known workarounds are available.

The record

Technical detail

CVSS v3.1: 5.4 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00206 · 10.1th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2025-12-29T20:16Z

Affected products (1)

Product	Versions	Fixed in
frappe/frappe_crm	< 1.56.2	1.56.2

References (3)

https://github.com/frappe/crm/commit/c5766d9989131d17d954e866bfc4b8d3b23e4f10 · [email protected]https://github.com/frappe/crm/releases/tag/v1.56.2 · [email protected]https://github.com/frappe/crm/security/advisories/GHSA-fm34-v6j7-chwc · [email protected]

EPSS history

Timeline

29 DEC 15:06Z
Frappe CRM vulnerable to authenticated XSS via website field
cvelistv5