Description
ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks in fields that are intended for plain text. Although JavaScript is blocked (preventing XSS), the HTML is still preserved in the generated PDF document. As a result, an attacker can inject malicious clickable links into an ERP-generated PDF. Since PDF files generated by the ERP system are generally considered trustworthy, users are highly likely to click these links, potentially enabling phishing attacks or malware delivery. This issue occurs in the Add Quality Goal' function.
INFO
Published Date :
2026-02-03T00:00:00.000Z
Last Modified :
2026-02-17T16:42:43.134Z
Source :
mitre
AFFECTED PRODUCTS
The following products are affected by CVE-2025-65924 vulnerability.
| Vendors | Products |
|---|---|
| Frappe |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-65924.
| URL | Resource |
|---|---|
| https://github.com/frappe/frappe_docker.git |
|