CVE-2025-71430

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-71430", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-12T21:01:34.725Z", "datePublished": "2026-10-12T22:21:46.441Z", "dateUpdated": "2026-10-18T12:13:29.396Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-12T22:21:46.441Z"}, "datePublic": "2025-12-24T00:00:00.000Z", "title": "Frappe before 15.91.1 Stored XSS via Leaderboard User Names", "descriptions": [{"lang": "en", "value": "Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper neutralization. Authenticated attackers can set a crafted user name that executes arbitrary JavaScript in the browsers of other users who view the leaderboard."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "affected": [{"vendor": "frappe", "product": "frappe", "defaultStatus": "unaffected", "packageURL": "pkg:pypi/frappe", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "14.99.10"}, {"version": "15.0.0", "status": "affected", "versionType": "semver", "lessThan": "15.91.1"}, {"version": "14.99.10", "status": "unaffected", "versionType": "semver"}, {"version": "15.91.1", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*", "versionStartIncluding": "15.0.0", "versionEndExcluding": "15.91.1"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*", "versionEndExcluding": "14.99.10"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/frappe/frappe/security/advisories/GHSA-cx24-w5gm-5vv9", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-cx24-w5gm-5vv9)"}, {"name": "VulnCheck Advisory: Frappe before 15.91.1 Stored XSS via Leaderboard User Names", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/frappe-before-15.91.1-stored-xss-via-leaderboard-user-names"}], "credits": [{"lang": "en", "value": "AS-AbdulSamad", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-71430", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-18T11:56:34.333051Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-18T12:13:29.396Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-71430", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-18T11:56:34.333051Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-18T12:03:40.840Z"}}], "cna": {"title": "Frappe before 15.91.1 Stored XSS via Leaderboard User Names", "credits": [{"lang": "en", "type": "reporter", "value": "AS-AbdulSamad"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 5.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "frappe", "product": "frappe", "versions": [{"status": "affected", "version": "0", "lessThan": "14.99.10", "versionType": "semver"}, {"status": "affected", "version": "15.0.0", "lessThan": "15.91.1", "versionType": "semver"}, {"status": "unaffected", "version": "14.99.10", "versionType": "semver"}, {"status": "unaffected", "version": "15.91.1", "versionType": "semver"}], "packageURL": "pkg:pypi/frappe", "defaultStatus": "unaffected"}], "datePublic": "2025-12-24T00:00:00.000Z", "references": [{"url": "https://github.com/frappe/frappe/security/advisories/GHSA-cx24-w5gm-5vv9", "name": "GitHub Security Advisory (GHSA-cx24-w5gm-5vv9)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/frappe-before-15.91.1-stored-xss-via-leaderboard-user-names", "name": "VulnCheck Advisory: Frappe before 15.91.1 Stored XSS via Leaderboard User Names", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper neutralization. Authenticated attackers can set a crafted user name that executes arbitrary JavaScript in the browsers of other users who view the leaderboard."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "15.91.1", "versionStartIncluding": "15.0.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "14.99.10"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-12T22:21:46.441Z"}}}, "cveMetadata": {"cveId": "CVE-2025-71430", "state": "PUBLISHED", "dateUpdated": "2026-10-18T12:13:29.396Z", "dateReserved": "2026-10-12T21:01:34.725Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-12T22:21:46.441Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:pypi/frappe", "product": "frappe", "vendor": "frappe", "versions": [{"lessThan": "14.99.10", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "15.91.1", "status": "affected", "version": "15.0.0", "versionType": "semver"}, {"status": "unaffected", "version": "14.99.10", "versionType": "semver"}, {"status": "unaffected", "version": "15.91.1", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper neutralization. Authenticated attackers can set a crafted user name that executes arbitrary JavaScript in the browsers of other users who view the leaderboard."}, {"lang": "es", "value": "Frappe en versiones anteriores a la 14.99.10 y 15.x en versiones anteriores a la 15.91.1 contiene una vulnerabilidad de Cross-site Scripting (XSS) almacenado en la p\u00e1gina de clasificaci\u00f3n (leaderboard) debido a que los nombres de usuario se renderizan sin una neutralizaci\u00f3n adecuada. Atacantes autenticados pueden establecer un nombre de usuario manipulado que ejecuta JavaScript arbitrario en los navegadores de otros usuarios que ven la p\u00e1gina de clasificaci\u00f3n."}], "id": "CVE-2025-71430", "lastModified": "2026-10-19T22:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-71430", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-18T11:56:34.333051Z", "version": "2.0.3"}}]}, "published": "2026-10-12T23:17:18.957", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/frappe/frappe/security/advisories/GHSA-cx24-w5gm-5vv9"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/frappe-before-15.91.1-stored-xss-via-leaderboard-user-names"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,14.99.10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[15.0.0,15.91.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "14.99.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "15.91.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "frappe", "source": "cna", "vendor": "frappe"}, "product": "frappe", "vendor": "frappe"}], "created": "2026-10-13T01:00:15.290426+00:00", "updated": "2026-10-13T04:30:17.641045+00:00", "vendors": ["frappe", "frappe$PRODUCT$frappe"]}