CVE-2026-44205

MediumCVSS 6.9

Published: 12/06/2026(UTC)Updated: 12/06/2026(UTC)Translated: 17/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.02%

7th percentile — higher than 7% of all known CVEs

Summary

Frappe is a web application framework. Prior to version 15.106.0, a stored XSS vulnerability in the user profile image section allowed an attacker to execute malicious scripts in the browsers of other users.

Risk Assessment

This vulnerability could lead to user data theft and session hijacking, posing a significant security risk to the organization.

Recommendation

It is recommended to upgrade to version 15.106.0 or later to mitigate this vulnerability.

Original NVD description (English source)

Frappe is a full-stack web application framework. Prior to version 15.106.0, a stored XSS vulnerability in the user profile image section allows an attacker to execute malicious scripts in the browsers of other users. This issue has been patched in version 15.106.0.