medium5.4
CVE-2025-71430
Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered wit…
Impact
Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper neutralization. Authenticated attackers can set a crafted user name that executes arbitrary JavaScript in the browsers of other users who view the leaderboard.
Affected products
| Product | Affected versions |
|---|---|
| Frappe | before 14.99.10 |
| 15.X | before 15.91.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.