CVE-2025-65267
CRITICAL
INFO
Priority: 0.03
BB Relevance:
58/100
Published: 2025-12-03
Modified: 2026-11-04
First seen: 2026-11-04
Status: active
Attack Surface
Network
Low Complexity
Conf. Impact
Integ. Impact
Scope Change
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
Required
S:
Changed
C:
High
I:
High
A:
High
Description
In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payload executes when an administrator clicks the image link to view the avatar, resulting in stored cross-site scripting (XSS). Successful exploitation may lead to account takeover, privilege escalation, or full compromise of the affected ERPNext instance.
Weakness Classification (1)
References & Advisories (3)
Third Party Advisory
Product
Product