EUVD-2026-34157
GHSA-w2pq-xvqr-7fqw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (Fluid Attacks) · only source for this CVE.
CVSS VectorVendor: Fluid Attacks
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
An authenticated user can persist arbitrary HTML/JavaScript in the email_id or mobile_no fields of a Customer record and trigger unescaped rendering in the Point of Sale (POS) interface for every operator who selects that customer. This issue affects ERPNext: 16.16.0.
AnalysisAI
Stored cross-site scripting in ERPNext 16.16.0 allows authenticated users to inject arbitrary HTML and JavaScript into the email_id or mobile_no fields of Customer records, which execute silently in the browser of every Point of Sale (POS) operator who subsequently selects the poisoned customer. Because the payload persists in the database, a single injection event affects all future POS operator sessions that encounter that customer - creating a multiplier effect without requiring repeated attacker access. No public exploit code or CISA KEV listing exists at time of analysis; EPSS data was not provided in available intelligence sources.
Technical ContextAI
ERPNext is an open-source enterprise resource planning platform built on the Frappe framework (CPE: cpe:2.3:a:frappe:erpnext). The vulnerability is a stored (persistent) variant of CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting). User-supplied data submitted to the email_id and mobile_no fields of Customer records is written to the database without adequate sanitization and is subsequently rendered in the Point of Sale interface without output encoding. When the POS module resolves a customer lookup, the raw field values are injected directly into the DOM, causing any embedded HTML or JavaScript to execute in the victim operator's browser. This is distinct from reflected XSS in that no crafted link needs to be delivered to the victim - the payload fires automatically whenever the affected customer record is accessed in the POS context.
RemediationAI
The primary remediation is to upgrade ERPNext beyond version 16.16.0 once a patched release is published by Frappe Technologies; as of this analysis, no specific fixed version has been confirmed - the upstream repository at https://github.com/frappe/erpnext and the Fluid Attacks advisory at https://fluidattacks.com/es/advisories/weeknd should be monitored for patch availability and associated release notes. As an immediate compensating control, administrators should audit and restrict Customer record write permissions (specifically the ability to edit email_id and mobile_no fields) to the minimum set of trusted roles, reducing the pool of accounts capable of injecting payloads - note this adds administrative overhead for legitimate customer data updates. Server-side input validation rejecting HTML special characters (<, >, &, ", ') on the email_id and mobile_no fields can block the injection vector without affecting legitimate email addresses or phone numbers, though this must be enforced at the application layer rather than client-side alone. Additionally, deploying a Content Security Policy (CSP) header that blocks inline script execution in the POS interface would prevent payload execution even if injection occurs, but this requires testing against ERPNext's own JavaScript dependencies to avoid breaking POS functionality.
Stored cross-site scripting leading to code execution in Frappe Framework 15.89.0 (and the ERPNext application built on
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. Rated high sev
In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/re
In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reco
In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Inje
In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_requ
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. Rated high severity (CV
In Frappe ERPNext v15.57.5, the function get_stock_balance() at erpnext/stock/utils.py is vulnerable to SQL Injection, w
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today