MEDIUM
CVE-2026-50701
CVSS
5.1
Description
A Reflected Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the dashboard-view component.
Summary dbcve.org
A reflected XSS vulnerability exists in Frappe Framework version 17.0.0-dev within the dashboard-view component. User-controlled input is improperly neutralized, allowing malicious scripts to be injected and executed in the context of other users' browsers when they access the crafted URL.
Mitigation
Implement proper input validation and output encoding/escaping in the dashboard-view component to ensure user-supplied data is safely rendered without executing as JavaScript.
Weakness (CWE)
CWE-79
Cross-site Scripting (XSS)
EPSS Score
0.45%
Probability of exploitation in next 30 days
38.7th percentile
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.