VULNERABILITY INTELLIGENCE

CVE-2025-62407

CVSS score6.1 MEDIUM
EPSS probability0.26%
CISA KEVNot currently listed
Published2025-10-16
Last modified2026-10-19
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

Frappe is a full-stack web application framework. Prior to 14.98.0 and 15.83.0, an open redirect was possible through the redirect argument on the login page, if a specific type of URL was passed in. This vulnerability is fixed in 14.98.0 and 15.83.0.

Weakness classification

  • security-advisories@github.com: CWE-601

Primary references