CVE-2025-56379

MediumCVSS 5.4/10Last modified Nov 5, 2026

Description

A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the content field.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/MoAlali/Not Applicable
https://github.com/MoAlali/CVE-2025-56379Exploit, Third Party Advisory
https://www.linkedin.com/in/mohammedaloli/Not Applicable
https://x.com/alaliksa_Not Applicable
https://github.com/MoAlali/CVE-2025-56379Exploit, Third Party Advisory

Timeline

Published: Oct 2, 2025
Last modified: Nov 5, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-56388.8A vulnerability has been found in PHPGurukul Notice Board System 1.0 and classified as critical. Affected by this vulnerability is an unknow CVE-2025-563806.5Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value CVE-2025-563816.5ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via CVE-2025-563826.1A stored Cross-site scripting (XSS) vulnerability exists in the Customer Management Module of LionCoders SalePro POS 5.4.8. An authenticated CVE-2025-563838.4Notepad++ v8.8.3 has a DLL hijacking vulnerability, which can replace the original DLL file to execute malicious code. NOTE: this is dispute CVE-2025-563859.8A SQL injection vulnerability exists in the login functionality of WellSky Harmony version 4.1.0.2.83 within the 'xmHarmony.asp' endpoint. U CVE-2025-56399.8A vulnerability was found in PHPGurukul Notice Board System 1.0 and classified as critical. Affected by this issue is some unknown functiona CVE-2025-563928.1An Insecure Direct Object Reference (IDOR) in the /dashboard/notes endpoint of Syaqui Collegetivity v1.0.0 allows attackers to impersonate o CVE-2025-563947.5Free5gc 4.0.1 is vulnerable to Buffer Overflow. The AMF incorrectly validates the 5GS mobile identity, resulting in slice reference overflow CVE-2025-563968.8An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due to the owning department having higher rights tha CVE-2025-563998.8alexusmai laravel-file-manager 3.3.1 and before allows an authenticated attacker to achieve Remote Code Execution (RCE) through a crafted fi CVE-2025-56403.3A vulnerability was found in PX4-Autopilot 1.12.3. It has been classified as problematic. This affects the function MavlinkReceiver::handle_