deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-15168
Published: 2025-12-29
Description: A vulnerability was identified in itsourcecode Student Management System 1.0. Affected is an unknown function of the file /statistical.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Susen2/cve/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.338547
CVE: CVE-2025-52691
Published: 2025-12-29
Description: Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/; https://github.com/watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691?ref=labs.watchtowr.com; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-52691
CVE: CVE-2025-15169
Published: 2025-12-29
Description: A weakness has been identified in BiggiDroid Simple PHP CMS 1.0. Affected by this issue is some unknown functionality of the file /admin/editsite.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://gitee.com/sun-huizhi/dazhi/issues/IDBDAY; https://vuldb.com/?ctiid.338549; https://vuldb.com/?id.338549
CVE: CVE-2025-15170
Published: 2025-12-29
Description: A security vulnerability has been detected in Advaya Softech GEMS ERP Portal up to 2.1. This affects an unknown part of the file /home.jsp?isError=true of the component Error Message Handler. The manipulation of the argument Message leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://syansec.in/video_poc/cve_2025.mp4; https://vuldb.com/?ctiid.338550; https://vuldb.com/?id.338550
CVE: CVE-2025-15171
Published: 2025-12-29
Description: A vulnerability was identified in SohuTV CacheCloud up to 3.2.0. This affects the function index of the file src/main/java/com/sohu/cache/web/controller/ServerController.java. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/sohutv/cachecloud/issues/367; https://github.com/sohutv/cachecloud/issues/367#issue[PII_REDACTED]; https://vuldb.com/?ctiid.338556
CVE: CVE-2025-15172
Published: 2025-12-29
Description: A security flaw has been discovered in SohuTV CacheCloud up to 3.2.0. This impacts the function preview of the file src/main/java/com/sohu/cache/web/controller/RedisConfigTemplateController.java. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be exploited. The project was informed of the problem early through an issue report but has not responded yet.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/sohutv/cachecloud/issues/368; https://github.com/sohutv/cachecloud/issues/368#issue[PII_REDACTED]; https://vuldb.com/?ctiid.338557
CVE: CVE-2025-15173
Published: 2025-12-29
Description: A weakness has been identified in SohuTV CacheCloud up to 3.2.0. Affected is the function advancedAnalysis of the file src/main/java/com/sohu/cache/web/controller/InstanceController.java. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited. The project was informed of the problem early through an issue report but has not responded yet.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/sohutv/cachecloud/issues/369; https://github.com/sohutv/cachecloud/issues/369#issue[PII_REDACTED]; https://vuldb.com/?ctiid.338558
CVE: CVE-2025-13417
Published: 2025-12-29
Description: The Plugin Organizer WordPress plugin before 10.2.4 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers to perform SQL injection attacks.
CVSS Score: 8.6 (HIGH)
References: https://wpscan.com/vulnerability/862fdf28-5195-443d-8ef2-e4043d0fdc92/
CVE: CVE-2025-13958
Published: 2025-12-29
Description: The YaMaps for WordPress Plugin WordPress plugin before 0.6.40 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.9 (MEDIUM)
References: https://wpscan.com/vulnerability/0d4bb338-f0d0-4b57-8664-1b8cba7cbe52/
CVE: CVE-2025-15068
Published: 2025-12-29
Description: Missing Authorization vulnerability in Gmission Web Fax allows Authentication Abuse, Session Credential Falsification through Manipulation.This issue affects Web Fax: from 3.0 before 3.0.1
CVSS Score: 7.7 (HIGH)
CWE: CWE-862
References: https://www.gmission.co.kr/fax1
CVE: CVE-2025-15069
Published: 2025-12-29
Description: Improper Authentication vulnerability in Gmission Web Fax allows Privilege Escalation.This issue affects Web Fax: from 3.0 before 3.0.1
CVSS Score: 7.1 (HIGH)
CWE: CWE-287
References: https://www.gmission.co.kr/fax1
CVE: CVE-2025-15070
Published: 2025-12-29
Description: Exposure of Sensitive Information to an Unauthorized Actor, Missing Authorization vulnerability in Gmission Web Fax allows Authentication Abuse.This issue affects Web Fax: from 3.0 before 3.0.1
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-862
References: https://www.gmission.co.kr/fax1
CVE: CVE-2025-15174
Published: 2025-12-29
Description: A security vulnerability has been detected in SohuTV CacheCloud up to 3.2.0. Affected by this vulnerability is the function doAppAuditList of the file src/main/java/com/sohu/cache/web/controller/AppManageController.java. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/sohutv/cachecloud/issues/370; https://github.com/sohutv/cachecloud/issues/370#issue[PII_REDACTED]; https://vuldb.com/?ctiid.338559
CVE: CVE-2025-15175
Published: 2025-12-29
Description: A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. Affected by this issue is the function doAppList/appCommandAnalysis of the file src/main/java/com/sohu/cache/web/controller/AppController.java. Performing manipulation results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/sohutv/cachecloud/issues/371; https://github.com/sohutv/cachecloud/issues/381; https://vuldb.com/?ctiid.338560
CVE: CVE-2025-15176
Published: 2025-12-29
Description: A flaw has been found in Open5GS up to 2.7.5. This affects the function decode_ipv6_header/ogs_pfcp_pdr_rule_find_by_packet of the file lib/pfcp/rule-match.c of the component PFCP Session Establishment Request Handler. Executing a manipulation can lead to reachable assertion. It is possible to launch the attack remotely. The exploit has been published and may be used. This patch is called b72d[PII_REDACTED]e2c033c8324f07747a86eea4f8. Applying a patch is advised to resolve this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-617
References: https://github.com/open5gs/open5gs/; https://github.com/open5gs/open5gs/commit/b72d[PII_REDACTED]e2c033c8324f07747a86eea4f8; https://github.com/open5gs/open5gs/issues/4180
CVE: CVE-2025-15177
Published: 2025-12-29
Description: A vulnerability has been found in Tenda WH450 1.0.0.18. This vulnerability affects unknown code of the file /goform/SetIpBind of the component HTTP Request Handler. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/SetIpBind/SetIpBind.md; https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/SetIpBind/SetIpBind.md#reproduce; https://vuldb.com/?ctiid.338562
CVE: CVE-2025-15225
Published: 2025-12-29
Description: WMPro developed by Sunnet has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to read arbitrary system files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-23, CWE-22
References: https://www.twcert.org.tw/en/cp-139-10603-67149-2.html; https://www.twcert.org.tw/tw/cp-132-10602-c1c69-1.html
CVE: CVE-2025-15226
Published: 2025-12-29
Description: WMPro developed by Sunnet has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.twcert.org.tw/en/cp-139-10603-67149-2.html; https://www.twcert.org.tw/tw/cp-132-10602-c1c69-1.html
CVE: CVE-2025-15178
Published: 2025-12-29
Description: A vulnerability was found in Tenda WH450 1.0.0.18. This issue affects some unknown processing of the file /goform/VirtualSer of the component HTTP Request Handler. The manipulation of the argument page results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/VirtualSer/VirtualSer.md; https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/VirtualSer/VirtualSer.md#reproduce; https://vuldb.com/?ctiid.338563
CVE: CVE-2025-15179
Published: 2025-12-29
Description: A vulnerability was determined in Tenda WH450 1.0.0.18. Impacted is an unknown function of the file /goform/qossetting. This manipulation of the argument page causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/qossetting/qossetting.md; https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/qossetting/qossetting.md#reproduce; https://vuldb.com/?ctiid.338564
CVE: CVE-2025-15227
Published: 2025-12-29
Description: BPMFlowWebkit developed by WELLTEND TECHNOLOGY has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path Traversal to download arbitrary system files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-36, CWE-22
References: https://www.twcert.org.tw/en/cp-139-10605-426b6-2.html; https://www.twcert.org.tw/tw/cp-132-10604-c65aa-1.html
CVE: CVE-2025-15228
Published: 2025-12-29
Description: BPMFlowWebkit developed by WELLTEND TECHNOLOGY has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.twcert.org.tw/en/cp-139-10605-426b6-2.html; https://www.twcert.org.tw/tw/cp-132-10604-c65aa-1.html
CVE: CVE-2025-15180
Published: 2025-12-29
Description: A vulnerability was identified in Tenda WH450 1.0.0.18. The affected element is an unknown function of the file /goform/webExcptypemanFilte of the component HTTP Request Handler. Such manipulation of the argument page leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/webExcptypemanFilter/webExcptypemanFilter.md; https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/webExcptypemanFilter/webExcptypemanFilter.md#reproduce; https://vuldb.com/?ctiid.338565
CVE: CVE-2025-15181
Published: 2025-12-29
Description: A security flaw has been discovered in code-projects Refugee Food Management System 1.0. The impacted element is an unknown function of the file /home/pagenateRefugeesList.php. Performing manipulation of the argument rfid results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/ctg503/CVE/issues/1; https://vuldb.com/?ctiid.338566
CVE: CVE-2025-15182
Published: 2025-12-29
Description: A weakness has been identified in code-projects Refugee Food Management System 1.0. This affects an unknown function of the file /home/served.php. Executing manipulation of the argument refNo can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/ctg503/CVE/issues/2; https://vuldb.com/?ctiid.338567
CVE: CVE-2025-15183
Published: 2025-12-29
Description: A security vulnerability has been detected in code-projects Refugee Food Management System 1.0. This impacts an unknown function of the file /home/viewtakenfd.php. The manipulation of the argument tfid leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/ctg503/CVE/issues/3; https://vuldb.com/?ctiid.338568
CVE: CVE-2025-15184
Published: 2025-12-29
Description: A vulnerability was detected in code-projects Refugee Food Management System 1.0. Affected is an unknown function of the file /home/refugeesreport2.php. The manipulation of the argument a results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/ctg503/CVE/issues/4; https://vuldb.com/?ctiid.338569
CVE: CVE-2025-15185
Published: 2025-12-29
Description: A flaw has been found in code-projects Refugee Food Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /home/refugeesreport.php. This manipulation of the argument a causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/ctg503/CVE/issues/5; https://vuldb.com/?ctiid.338570
CVE: CVE-2025-15186
Published: 2025-12-29
Description: A vulnerability has been found in code-projects Refugee Food Management System 1.0. Affected by this issue is some unknown functionality of the file /home/addusers.php. Such manipulation of the argument a leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/ctg503/CVE/issues/6; https://vuldb.com/?ctiid.338571
CVE: CVE-2025-15187
Published: 2025-12-29
Description: A vulnerability was found in GreenCMS up to 2.3. This affects an unknown part of the file /DataController.class.php of the component File Handler. Performing a manipulation of the argument sqlFiles/zipFiles results in path traversal. The attack can be initiated remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 3.8 (LOW)
CWE: CWE-22
References: https://github.com/ueh1013/VULN/issues/4; https://github.com/ueh1013/VULN/issues/5; https://vuldb.com/?ctiid.338572
CVE: CVE-2025-15188
Published: 2025-12-29
Description: A vulnerability was determined in Campcodes Complete Online Beauty Parlor Management System 1.0. This vulnerability affects unknown code of the file /admin/search-invoices.php. Executing a manipulation of the argument searchdata can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/BUPT2025201/CVE/issues/1; https://vuldb.com/?ctiid.338573; https://vuldb.com/?id.338573
CVE: CVE-2025-15189
Published: 2025-12-29
Description: A vulnerability was identified in D-Link DWR-M920 up to 1.1.50. This issue affects the function sub_464794 of the file /boafrm/formDefRoute. The manipulation of the argument submit-url leads to buffer overflow. The attack may be initiated remotely. The exploit is publicly available and might be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/panda666-888/vuls/blob/main/d-link/dwr-m920/formDefRoute.md; https://github.com/panda666-888/vuls/blob/main/d-link/dwr-m920/formDefRoute.md#poc; https://vuldb.com/?ctiid.338574
CVE: CVE-2025-15190
Published: 2025-12-29
Description: A security flaw has been discovered in D-Link DWR-M920 up to 1.1.50. Impacted is the function sub_42261C of the file /boafrm/formFilter. The manipulation of the argument ip6addr results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/panda666-888/vuls/blob/main/d-link/dwr-m920/formFilter.md; https://github.com/panda666-888/vuls/blob/main/d-link/dwr-m920/formFilter.md#poc; https://vuldb.com/?ctiid.338575
CVE: CVE-2025-15191
Published: 2025-12-29
Description: A weakness has been identified in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_4155B4 of the file /boafrm/formLtefotaUpgradeFibocom. This manipulation of the argument fota_url causes command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/panda666-888/vuls/blob/main/d-link/dwr-m920/formLtefotaUpgradeFibocom.md; https://github.com/panda666-888/vuls/blob/main/d-link/dwr-m920/formLtefotaUpgradeFibocom.md#poc; https://vuldb.com/?ctiid.338576
CVE: CVE-2025-57460
Published: 2025-12-29
Description: File upload vulnerability in machsol machpanel 8.0.32 allows attacker to gain a webshell.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/aljoharasubaie/CVE-2025-57460/blob/main/README.md; https://www.machsol.com/
CVE: CVE-2025-15192
Published: 2025-12-29
Description: A security vulnerability has been detected in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub_415328 of the file /boafrm/formLtefotaUpgradeQuectel. Such manipulation of the argument fota_url leads to command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/panda666-888/vuls/blob/main/d-link/dwr-m920/formLtefotaUpgradeQuectel.md; https://github.com/panda666-888/vuls/blob/main/d-link/dwr-m920/formLtefotaUpgradeQuectel.md#poc; https://vuldb.com/?ctiid.338577
CVE: CVE-2025-15193
Published: 2025-12-29
Description: A vulnerability was detected in D-Link DWR-M920 up to 1.1.50. This affects the function sub_423848 of the file /boafrm/formParentControl. Performing manipulation of the argument submit-url results in buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/panda666-888/vuls/blob/main/d-link/dwr-m920/formParentControl.md; https://github.com/panda666-888/vuls/blob/main/d-link/dwr-m920/formParentControl.md#poc; https://vuldb.com/?ctiid.338578
CVE: CVE-2025-57462
Published: 2025-12-29
Description: Stored cross-site scripting (xss) in machsol machpanel 8.0.32 allows attackers to execute arbitrary web scripts or HTML via a crafted PDF file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/aljoharasubaie/CVE-2025-57462/blob/main/README.md; https://www.machsol.com/
CVE: CVE-2025-60458
Published: 2025-12-29
Description: UxPlay 1.72 contains a double free vulnerability in its RTSP request handling. A specially crafted RTSP TEARDOWN request can trigger multiple calls to free() on the same memory address, potentially causing a Denial of Service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/0pepsi/CVE-2025-60458
CVE: CVE-2025-65442
Published: 2025-12-29
Description: DOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or disclose sensitive information (e.g., user session cookies) via a crafted "wvstest" parameter in the URL or malicious script injection into window.localStorage. The vulnerability arises from insufficient validation and encoding of user-controllable data in the book comment module: unfiltered user input is stored in the backend database (book_comment table, commentContent field) and returned via API, then rendered directly into the page DOM via Vue 3's v-html directive without sanitization. Even if modern browsers' built-in XSS filters block pop-up alerts, attackers can use concealed payloads to bypass interception and achieve actual harm.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/201206030/novel; https://github.com/201206030/novel-front-web; https://github.com/zero-day348/DOM-based-Cross-Site-Scripting-XSS-Vulnerability-in-novel-V3.5.0-CWE-79-
CVE: CVE-2025-65570
Published: 2025-12-29
Description: A type confusion in jsish 2.0 allows incorrect control flow during execution of the OP_NEXT opcode. When an “instanceof” expression uses an array element access as the left-hand operand inside a for-in loop, the instructions implementation leaves an additional array reference on the stack rather than consuming it during OP_INSTANCEOF. As a result, OP_NEXT interprets the array as an iterator object and reads the iterCmd function pointer from an invalid structure, potentially causing a crash or enabling code execution depending on heap layout.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-843
References: https://blog.mcsky.ro/writeups/2025/11/15/inline8-writeup.html; https://blog.mcsky.ro/writeups/2025/11/15/inline8-writeup.html
CVE: CVE-2025-68928
Published: 2025-12-29
Description: Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, which were not sanitized, causing cross-site scripting. Version 1.56.2 fixes the issue. No known workarounds are available.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/frappe/crm/commit/c5766d9989131d17d954e866bfc4b8d3b23e4f10; https://github.com/frappe/crm/releases/tag/v1.56.2; https://github.com/frappe/crm/security/advisories/GHSA-fm34-v6j7-chwc