Stored Cross-Site Scripting in Frappe ERPNext Affecting Public Portal Forms

CVE-2026-109662

What is CVE-2026-109662?

A stored cross-site scripting vulnerability exists in Frappe ERPNext versions prior to 15.112.0 and 16.x before 16.23.0. This issue arises within a public portal form that allows unauthenticated user submissions. Due to insufficient neutralization of stored content, an attacker can inject malicious markup, which may execute in the browser sessions of administrators reviewing the stored entries, potentially leading to unauthorized actions or data disclosure.

References