CVE-2026-28436

HIGH

7.2

Descripcion

Frappe is a full-stack web application framework. Prior to versions 16.11.0 and 15.102.0, an attacker can set a crafted image URL that results in XSS when the avatar is displayed, and it can be triggered for other users via website page comments. This issue has been patched in versions 16.11.0 and 15.102.0.

Detalles CVE

Puntuacion CVSS v3.17.2

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado3/5/2026

Ultima modificacion3/9/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

frappe:frappe

Debilidades (CWE)

CWE-79

Referencias

https://github.com/frappe/frappe/security/advisories/GHSA-vm63-r48g-7wqh(security-advisories@github.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.