CVE-2025-65924
- State
- Published
- Severity
- 4.1 Medium
- Published
- Feb 3, 2026
- Updated
- Feb 17, 2026
- Reserved
- Nov 18, 2025
Description
ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks in fields that are intended for plain text. Although JavaScript is blocked (preventing XSS), the HTML is still preserved in the generated PDF document. As a result, an attacker can inject malicious clickable links into an ERP-generated PDF. Since PDF files generated by the ERP system are generally considered trustworthy, users are highly likely to click these links, potentially enabling phishing attacks or malware delivery. This issue occurs in the Add Quality Goal' function.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.1 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N | CISA-ADP |
Weaknesses
- CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.