CVE-2025-68928
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, which were not sanitized, causing cross-site scripting. Version 1.56.2 fixes the issue.
Risk Assessment
An attacker with a valid account can inject malicious script that executes in other users' browsers, enabling session or data theft. This can lead to account takeover and unauthorized actions within the CRM system.
Recommendation
Update Frappe CRM to version 1.56.2 or later. No known workarounds are available — updating is the only solution.
Other vulnerabilities in Frappe CRM
See all- CVE-2026-108734Medium
Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_document that allows authenticated users to read linked documents without permission checks. Attackers can name a lead, deal, comment or user they cannot read to obtain linked call log phone numbers, deal organizations and mention notification text.
- CVE-2026-53761High
Frappe CRM prior to version 1.73.0 has an authentication bypass vulnerability via logged invitation keys in crm/api. An attacker can exploit these keys to gain unauthorized access.
Original NVD description (English source)
Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, which were not sanitized, causing cross-site scripting. Version 1.56.2 fixes the issue. No known workarounds are available.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS