HTML Tag Injection Vulnerability in ERPNext by Frappe
CVE-2025-65924

4.1MEDIUM

Key Information:

Vendor

Frappe

Status
ERPNext
Vendor
CVE Published:
3 February 2026

What is CVE-2025-65924?

ERPNext versions up to 15.88.1 feature a vulnerability that allows the injection of HTML tags, specifically <a> hyperlinks, into fields intended for plain text input. While the application blocks JavaScript execution, the unsanitized HTML persists in the generated PDF documents. This flaw can be exploited by attackers to embed malicious links within ERP-generated PDFs, which users often trust and are likely to click, subsequently leading to phishing scenarios or delivering malware.

References

https://github.com/frappe/frappe_docker.git

CVSS V3.1

Score:
4.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.