Frappe Framework EUVD-2025-211072

The attacker must hold an authenticated Frappe account capable of setting its own user/display name (PR:L), and a victim must actively navigate to the Frappe leaderboard page for the stored payload to execute (UI:P). The specific vulnerable feature is the leaderboard page, which renders user names without output neutralization. Exploitation is meaningfully amplified on instances that permit self-service account registration and is limited by: the need for a valid account, the requirement that victims view the leaderboard, and the affected version range (Frappe before 14.99.10 and 15.x before 15.91.1) - patched instances (>=14.99.10 or >=15.91.1) are not affected.

This is a stored (persistent) cross-site scripting flaw (CWE-79) in the Frappe framework's leaderboard page, scored CVSS 4.0 5.1 (MEDIUM). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) indicates network-reachable, low-complexity exploitation that requires LOW privileges (PR:L - an authenticated account to set a crafted user name) and passive user interaction (UI:P - a victim must view the leaderboard). The impact is confined to the subsequent system (the victim's browser): no direct confidentiality/integrity/availability impact on the vulnerable server itself (VC/VI/VA:N), with low confidentiality and integrity impact on the browser context (SC:L/SI:L). There is NO CISA KEV listing, NO EPSS score, and NO public PoC referenced in the provided data - so exploitation signals are all negative/absent. The result is a genuine but modest-priority vulnerability: real because exploitation prerequisites are low (any authenticated user can plant the payload) and the payload fires automatically for every leaderboard viewer, but limited because it requires an authenticated foothold, victim interaction, and yields only in-browser script execution rather than server compromise. EPSS and KEV data are missing rather than low, so widespread-exploitation likelihood cannot be quantified - treat as a patch-in-routine-cycle item unless the Frappe instance exposes self-service/public account registration, which would raise the practical risk.

An authenticated Frappe user (e.g., on an instance that allows self-registration) sets their display name to a string containing a JavaScript payload. When administrators or other users open the leaderboard page, the unsanitized name renders and the script executes in their browser session, enabling session-token theft or actions-on-behalf. No public exploit code is referenced, but the attack is trivial given low complexity (AC:L) and only low privileges (PR:L).