{“lastseen”:””,”description”:”In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payload executes when an administrator clicks the image link to view the avatar, resulting in stored cross-site scripting (XSS). Successful exploitation may lead to account takeover, privilege escalation, or full compromise of the affected ERPNext instance.”,”published”:”2025-12-03T00:00:00.000Z”,”modified”:”2025-12-03T15:13:30.219Z”,”type”:”cve”,”title”:”CVE-2025-65267″,”source”:”mitre”,”references”:”https:\/\/github.com\/frappe\/frappe\\nhttps:\/\/github.com\/frappe\/erpnext\\nhttps:\/\/github.com\/PhDg1410\/CVE\/tree\/main\/CVE-2025-65267″,”id”:”CVE-2025-65267″,”bulletinFamily”:””,”cwe”:[“CWE-79″],”cvelist”:null,”sourceData”:”n\/a n\/a n\/a”,”sourceHref”:””,”cvss”:{“score”:9,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”ERPNext, Frappe Framework”,”version”:”15.83.2, 15.86.0″,”vendor”:”Frappe Technologies”,”ai_description”:”Stored cross-site scripting (XSS) vulnerability in ERPNext and Frappe Framework due to improper validation of uploaded SVG avatar images”,”ai_severity”:”Critical”,”ai_vendor”:”Frappe Technologies”,”ai_product”:”ERPNext, Frappe Framework”,”ai_version”:”15.83.2, 15.86.0″,”ai_score”:9}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payload executes when an…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[9,6,8,86,12,13,7,11,5],"class_list":["post-28553","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-critical","tag-cve","tag-cvss","tag-cvss-90","tag-exploit","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n