CVE-2025-68928

Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, which were not sanitized, causing cross-site scripting. Version 1.56.2 fixes the issue. No known workarounds are available.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/frappe/crm/commit/c5766d9989131d17d954e866bfc4b8d3b23e4f10	Patch
https://github.com/frappe/crm/releases/tag/v1.56.2	Release Notes
https://github.com/frappe/crm/security/advisories/GHSA-fm34-v6j7-chwc	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:frappe:frappe_crm:*:*:*:*:*:*:*:*

History

05 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Frappe CRM es una herramienta de gestión de relaciones con clientes de código abierto. Antes de la versión 1.56.2, los usuarios autenticados podían establecer URLs manipuladas en un campo de sitio web, las cuales no estaban saneadas, causando cross-site scripting. La versión 1.56.2 soluciona el problema. No se conocen soluciones alternativas disponibles.

Information

Published : 2025-12-29 15:16

Updated : 2026-10-07 12:10

NVD link : CVE-2025-68928

Mitre link : CVE-2025-68928

CVE.ORG link : CVE-2025-68928

JSON object : View

Products Affected

frappe

frappe_crm

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-68928", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-68928", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-29T16:12:20.126413Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "frappe", "product": "crm", "versions": [{"status": "affected", "version": "< 1.56.2"}]}]}], "published": "2025-12-29T15:16:01.877", "references": [{"url": "https://github.com/frappe/crm/commit/c5766d9989131d17d954e866bfc4b8d3b23e4f10", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/frappe/crm/releases/tag/v1.56.2", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/frappe/crm/security/advisories/GHSA-fm34-v6j7-chwc", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, which were not sanitized, causing cross-site scripting. Version 1.56.2 fixes the issue. No known workarounds are available."}, {"lang": "es", "value": "Frappe CRM es una herramienta de gesti\u00f3n de relaciones con clientes de c\u00f3digo abierto. Antes de la versi\u00f3n 1.56.2, los usuarios autenticados pod\u00edan establecer URLs manipuladas en un campo de sitio web, las cuales no estaban saneadas, causando cross-site scripting. La versi\u00f3n 1.56.2 soluciona el problema. No se conocen soluciones alternativas disponibles."}], "lastModified": "2026-10-07T12:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:frappe:frappe_crm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AECE80E4-EBC0-4DCC-BAFE-4C76A7D67D8F", "versionEndExcluding": "1.56.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}