What’s Vulnerable › Vulnerabilities

CVE-2025-65267

• Severity: critical (CVSS 9.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-03 · updated 2026-06-17
• Weakness: CWE-79

Description

In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payload executes when an administrator clicks the image link to view the avatar, resulting in stored cross-site scripting (XSS). Successful exploitation may lead to account takeover, privilege escalation, or full compromise of the affected ERPNext instance.

Affected products

• frappe erpnext: 15.83.2
• frappe: 15.86.0

References

• https://github.com/PhDg1410/CVE/tree/main/CVE-2025-65267
• https://github.com/frappe/erpnext
• https://github.com/frappe/frappe

Get alerted when CVE-2025-65267 or the next vulnerability affects your stack