CVE-2025-65267

{
  "id": "CVE-2025-65267",
  "sourceIdentifier": "[email protected]",
  "published": "2025-12-03T15:15:55.103",
  "lastModified": "2026-11-04T22:10:00.210",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payload executes when an administrator clicks the image link to view the avatar, resulting in stored cross-site scripting (XSS). Successful exploitation may lead to account takeover, privilege escalation, or full compromise of the affected ERPNext instance."
    },
    {
      "lang": "es",
      "value": "En ERPNext v15.83.2 y Frappe Framework v15.86.0, la validación inadecuada de las imágenes de avatar SVG cargadas permite a los atacantes incrustar JavaScript malicioso. La carga útil se ejecuta cuando un administrador hace clic en el enlace de la imagen para ver el avatar, lo que resulta en cross-site scripting (XSS) almacenado. La explotación exitosa puede conducir a la toma de control de la cuenta, escalada de privilegios o compromiso total de la instancia de ERPNext afectada."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "baseScore": 9.0,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-12-03T15:12:13.905744Z",
          "id": "CVE-2025-65267",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:frappe:erpnext:15.83.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8938912-6E20-4913-A21C-321B5C9D9EE8"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:frappe:frappe:15.86.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "B5DC3F26-8D6D-4530-857A-A7D72CE5A711"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/PhDg1410/CVE/tree/main/CVE-2025-65267",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/frappe/erpnext",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://github.com/frappe/frappe",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    }
  ]
}