# CVE-2025-68928: Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could…

Source: https://junglewise.ai/threats/cve-2025-68928-frappe-crm-is-an-open-source-customer-relationship-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-29  
License: CC BY 4.0 with a link back

CVE-2025-68928 · Severity: medium · CVSS 5.4 · Published 2025-12-29

Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, which were not sanitized, causing cross-site scripting. Version 1.56.2 fixes the issue. No known workarounds are available.

Technologies: [Frappe Crm](https://junglewise.ai/threats/technologies/frappe-crm). Vendors: [Frappe](https://junglewise.ai/threats/vendors/frappe).

## Quick answers

**Is CVE-2025-68928 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-68928 being exploited in the wild.

**How severe is CVE-2025-68928?** Medium severity, with a CVSS score of 5.4, published 29 December 2025.

**Which products and versions are affected?** Frappe Crm. The advisory does not name versions.

**Is there a fix for CVE-2025-68928?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-68928?** Check whether you run Frappe Crm. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Frappe Crm

## Related threats

- [Frappe CRM missing authorization in phone lookup API](https://junglewise.ai/threats/cve-2026-116492-frappe-crm-app-before-1-89-1-contains-a-missing-authorization)
- [Frappe CRM missing authorization in call log modification](https://junglewise.ai/threats/cve-2026-111938-frappe-crm-before-1-74-0-contains-a-missing-authorization)
- [Frappe CRM missing authorization in notifications](https://junglewise.ai/threats/cve-2026-111937-frappe-crm-before-1-81-2-contains-a-missing-authorization)
- [Frappe CRM missing authorization in get_linked_docs_of_document](https://junglewise.ai/threats/cve-2026-108734-frappe-crm-1-49-0-through-1-87-0-contains-a-missing)
- [Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters…](https://junglewise.ai/threats/cve-2025-11461-multiple-sql-injections-in-frappe-crm-dashboard-controller-due-to)