CVE-2025-65923

A Stored Cross-Site Scripting (XSS) vulnerability was discovered within the CSV import mechanism of ERPNext thru 15.88.1 when using the Update Existing Recordsoption. An attacker can embed malicious JavaScript code into a CSV field, which is then stored in the database and executed whenever the affected record is viewed by a user within the ERPNext web interface. This exposure may allow an attacker to compromise user sessions or perform unauthorized actions under the context of a victim's account.

• CWE-79

• https://github.com/frappe/frappe_docker.gitProduct

Published

Feb 3, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-65899Kalmia CMS version 0.2.0 contains a user enumeration vulnera…5.3
• CVE-2025-6590Exposure of Sensitive Information to an Unauthorized Actor v…4.6
• CVE-2025-65900Kalmia CMS version 0.2.0 contains an Incorrect Access Contro…6.5
• CVE-2025-6591Vulnerability in Wikimedia Foundation MediaWiki. This vulner…0
• CVE-2025-6592Vulnerability in Wikimedia Foundation AbuseFilter. This vuln…2.1
• CVE-2025-65922PLANKA 2.0.0 lacks X-Frame-Options and CSP frame-ancestors h…4.3
• CVE-2025-65924ERPNext thru 15.88.1 does not sanitize or remove certain HTM…4.1
• CVE-2025-65925An issue was discovered in Zeroheight (SaaS) prior to 2025-0…6.5
• CVE-2025-6593Vulnerability in Wikimedia Foundation MediaWiki. This vulner…2.1
• CVE-2025-65933Rejected reason: Not used
• CVE-2025-65934Rejected reason: Not used
• CVE-2025-65935Rejected reason: Not used