Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-109633: Frappe ERPNext public booking page can let attackers hijack accounts
CVE-2026-109633 · published 3 days ago
Summary
A flaw in ERPNext's public booking page stores any information entered without cleaning it. An attacker who does not need to log in can place special code that runs in the browser of a logged‑in administrator, giving the attacker control of that account. Install the latest ERPNext updates (15.119.1 or later, or 16.32.0 or later) to fix the problem.
What to do
- Update frappe erpnext to version 15.119.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| frappe | erpnext | < 15.119.1 |
Original advisory text
Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can submit crafted content that is rendered as raw HTML in a privileged user's session, executing script to act as that user and take over the account.
References
- https://github.com/frappe/erpnext/security/advisories/GHSA-rv4r-c8v3-3hrc Vendor Advisory
- https://www.vulncheck.com/advisories/frappe-erpnext-before-15.119.1-stored-xss-v... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-1096... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-109633 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
9.1
Critical
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published12 Oct 2026
Updated14 Oct 2026
First seen12 Oct 2026
Sources
CVE-2026-109633 · NVD
CVE-2026-109633 · MITRE
CVE-2026-109633 · OSV
GHSA-rv4r-c8v3-3hrc · GHSA
Track software like this
Free during beta