CVE-2025-68928: Frappe CRM

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, which were not sanitized, causing cross-site scripting. Version 1.56.2 fixes the issue. No known workarounds are available.

Affected products

• Frappe Frappe CRM: before 1.56.2 (fixed in 1.56.2)

Published 2025-12-29. Last modified 2026-10-07.