CVE-2025-65924 Details
Description
ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks in fields that are intended for plain text. Although JavaScript is blocked (preventing XSS), the HTML is still preserved in the generated PDF document. As a result, an attacker can inject malicious clickable links into an ERP-generated PDF. Since PDF files generated by the ERP system are generally considered trustworthy, users are highly likely to click these links, potentially enabling phishing attacks or malware delivery. This issue occurs in the Add Quality Goal' function.
A vulnerability exists in ERPNext versions through 15.88.1, allowing the injection of unfiltered HTML, specifically hyperlinks, into fields meant for plain text. While JavaScript execution is blocked, preventing cross-site scripting, the injected HTML is retained in PDFs generated by the ERP system. This flaw can be exploited to insert malicious clickable links into these PDFs. Given that ERP-generated PDF documents are typically regarded as reliable, there is a significant risk that users will click on these links, potentially leading to phishing attacks or the distribution of malware. This vulnerability is present in the 'Add Quality Goal' function.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/frappe/frappe_docker.git | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-80 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| frappe erpnext | <= 15.88.1 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Feb 17, 2026 | CVE Modified | CISA-ADP |
| Feb 11, 2026 | Initial Analysis | [email protected] |
| Feb 5, 2026 | CVE Modified | CISA-ADP |
| Feb 4, 2026 | CVE Modified | CISA-ADP |
| Feb 3, 2026 | New CVE Received | [email protected] |