CVE-2025-68928

MEDIUM 5.4CVE-2025-68928 · Published 29/12/2025 · updated 07/10/2026

In short

CVE-2025-68928 is a MEDIUM (CVSS 5.4) vulnerability affecting frappe crm (frappe).
Chance of exploitation in the next 30 days (EPSS): 0.21%, higher than 10.7% of all vulnerabilities.
Fix: update to 1.56.2 or later.

Package	Affected versions	Patched versions
frappe crm frappe	`< 1.56.2`	`1.56.2`

Description

Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, which were not sanitized, causing cross-site scripting. Version 1.56.2 fixes the issue. No known workarounds are available.

References

frappe/crm commit c5766d9 · Patch
frappe/crm release v1.56.2 · Release Notes
frappe/crm security advisory · Vendor Advisory

More vulnerabilities in frappe crm

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free