Frappe ERPNext EUVD-2025-211074

Exploitation requires (1) a victim who is already authenticated to the ERPNext instance, and (2) that victim to open an attacker-crafted URL (UI:P), so delivery depends on phishing or social engineering rather than a direct server attack. The attacker themselves needs no credentials (PR:N) and no special network position beyond reachability of the ERPNext web interface. The flaw stems from missing input validation on a specific (undisclosed) page that reflects attacker-controlled input into the response. Limiting factors: the required user interaction, the need for the victim to hold an active session, and the requirement that the specific vulnerable page be reached with the crafted parameter; instances not exposed to attacker-reachable users or with staff trained against malicious links face reduced practical risk.

This is a genuinely notable issue but should be triaged below a network-exploitable, zero-interaction RCE. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, VC:H/VI:H) correctly captures a reflected XSS that an unauthenticated attacker can trigger remotely, but with the critical constraint of UI:P - a logged-in victim must actively open a crafted URL, so this is social-engineering-gated rather than self-propagating. No EPSS score was supplied, so quantitative exploitation probability cannot be assessed. The flaw is NOT in CISA KEV and no POC was provided in the intelligence, so there is no evidence of active exploitation or weaponized code; credibility rests on VulnCheck's advisory and the vendor GHSA. No SSVC decision data was provided. Net: a high-impact (account-takeover) vulnerability whose real-world risk is moderated by the required user interaction and authenticated-victim precondition - a real patch priority for internet-exposed ERPNext instances, but not an emergency on par with unauthenticated RCE.

An attacker crafts a URL pointing at the vulnerable ERPNext page with a malicious JavaScript payload embedded in an unvalidated parameter, then delivers it to a target via phishing, chat, or a malicious link. When a logged-in ERPNext user opens the link, the reflected script executes in their authenticated session and can exfiltrate session tokens or perform actions to take over the account. No public exploit code was identified in the provided intelligence, so this scenario is inferred from the description and CVSS vector.