CVE-2026-109662— Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form
Quick assessment
Affected
frappe erpnext
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Frappe ERPNext 15.112.0 之前的版本以及 16.x 分支中 16.23.0 之前的版本中，存在一个存储型跨站脚本（XSS）漏洞。该漏洞出现在一个允许未认证提交且后续渲染时内容中立化不足的公共门户表单中。未经认证的攻击者可以提交构造好的恶意标记，当工作人员查看并呈现该存储记录时，这些恶意标记将在其浏览器会话中执行。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109662
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form
Source: CVE Program / CVE List V5
Vulnerability Description
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissions and stores content later rendered with insufficient neutralisation. Unauthenticated attackers can submit crafted markup that executes in the browser sessions of staff who review the stored record.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-109662
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109662
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-109662 (2)
Same Patch Batch · frappe · 2026-10-12 · 86 CVEs total
| CVE-2026-109608 | 8.8 HIGH | Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input |
| CVE-2024-58390 | 8.8 HIGH | Frappe before 15.41.0 Privilege Escalation via Document Action |
| CVE-2026-109652 | 8.8 HIGH | Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields |
| CVE-2026-109667 | 8.8 HIGH | Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation |
| CVE-2026-109640 | 8.1 HIGH | Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modificatio |
| CVE-2026-109633 | 8.1 HIGH | Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page |
| CVE-2025-71432 | 8.1 HIGH | Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover |
| CVE-2026-109612 | 7.3 HIGH | Frappe ERPNext before 15.120.0 Stored XSS via Report View |
| CVE-2026-109604 | 7.3 HIGH | ERPNext before 15.112.0 Stored XSS via Tool View Record Names |
| CVE-2026-109671 | 7.3 HIGH | Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages |
| CVE-2026-109653 | 7.3 HIGH | Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover |
| CVE-2026-109673 | 7.3 HIGH | Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names |
| CVE-2026-109616 | 7.1 HIGH | Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification |
| CVE-2026-109617 | 7.1 HIGH | Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints |
| CVE-2026-109613 | 7.1 HIGH | Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modificati |
| CVE-2026-109663 | 6.5 MEDIUM | Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters |
| CVE-2026-109615 | 6.5 MEDIUM | Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints |
| CVE-2026-109610 | 6.5 MEDIUM | Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modifica |
| CVE-2026-109645 | 6.5 MEDIUM | Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization |
| CVE-2026-109658 | 6.5 MEDIUM | Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints |
Showing top 20 of 86 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: erpnext
-
CVE-2026-109674
Frappe ERPNext before 16.6.0 SQL Injection via Missing Input -
CVE-2026-109672
Frappe ERPNext before 15.118.0 Missing Authorization Exposes -
CVE-2026-109673
Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record -
CVE-2026-109671
Frappe ERPNext before 15.113.0 Stored XSS via Profile Field -
CVE-2026-109670
Frappe ERPNext before 15.110.0 Stored XSS via Item Record Na
Same vendor: frappe
-
CVE-2026-55823
Frappe: Possibility of SQL injection in reportview -
CVE-2026-66057
Frappe: Open Redirect via Unsanitized OAuth State Param. -
CVE-2026-109675
Frappe Suite before commit 2697564 Broken Access Control in -
CVE-2026-109674
Frappe ERPNext before 16.6.0 SQL Injection via Missing Input -
CVE-2026-109672
Frappe ERPNext before 15.118.0 Missing Authorization Exposes
Same weakness: CWE-79
-
CVE-2026-110849
n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binar -
CVE-2026-110847
n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat -
CVE-2026-69194
FileRise: Unsanitized footerHtml in Public Site Config -
CVE-2026-0316
PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability -
CVE-2026-54701
Markdown Preview Enhanced: Stored XSS via Unsanitized `.cros
V. Comments for CVE-2026-109662
No comments yet