Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissions and stores content later rendered with insufficient neutralisation. Unauthenticated attackers can submit crafted markup that executes in the browser sessions of staff who review the stored record.
CVE-2026-109662
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-109662
erpnext
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "frappe",
"product": "erpnext",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "15.112.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "16.0.0-beta.1",
"lessThan": "16.23.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "15.112.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.23.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-109662
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #21820 · Revision 1
- Added to Heist Feed
- Publisher date