CVE-2026-47739

MediumCVSS 6.9

Published: 12/06/2026(UTC)Updated: 12/06/2026(UTC)Translated: 17/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.02%

7th percentile — higher than 7% of all known CVEs

Summary

Frappe is a web application framework, and prior to versions 15.106.0 and 16.16.0, there was a stored XSS vulnerability in the Note module due to lack of sanitization. This issue has been patched in versions 15.106.0 and 16.16.0.

Risk Assessment

Organizations may be exposed to XSS attacks, which could lead to user data theft or session hijacking. Exploiting this vulnerability could compromise the integrity of the application.

Recommendation

It is recommended to upgrade to versions 15.106.0 or 16.16.0 to eliminate this vulnerability. A security audit of the application should also be conducted.

Original NVD description (English source)

Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, stored XSS in Note was possible due to lack of sanitization. This issue has been patched in versions 15.106.0 and 16.16.0.