Filtered by vendor Frappe
Subscribe
Total
131 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-40888 | 1 Frappe | 1 Frappe Hr | 2026-06-17 | N/A | 6.5 MEDIUM |
| Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an authenticated user with default role can access unauthorized information by exploiting certain api endpoint. Versions 15.58.1 and 16.4.1 contain a patch. No known workarounds are available. | |||||
| CVE-2026-3837 | 1 Frappe | 1 Frappe | 2026-06-17 | N/A | 5.4 MEDIUM |
| An authenticated attacker can persist crafted values in multiple field types and trigger client-side script execution when another user opens the affected document in Desk. The vulnerable formatter implementations interpolate stored values into raw HTML attributes and element content without escaping This issue affects Frappe: 16.10.0. | |||||
| CVE-2026-3673 | 1 Frappe | 1 Frappe | 2026-06-17 | N/A | 5.4 MEDIUM |
| An authenticated attacker can store a crafted tag value in _user_tags and trigger JavaScript execution when a victim opens the list/report view where tags are rendered. The vulnerable renderer interpolates tag content into HTML attributes and element content without escaping. This issue affects Frappe: 16.10.10. | |||||
| CVE-2026-35614 | 1 Frappe | 1 Frappe | 2026-06-17 | N/A | 9.8 CRITICAL |
| Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe has a SQL injection in bulk_update. This vulnerability is fixed in 16.14.0 and 15.104.0. | |||||
| CVE-2026-32954 | 1 Frappe | 1 Erpnext | 2026-06-17 | N/A | 7.1 HIGH |
| ERP is a free and open source Enterprise Resource Planning tool. In versions prior to 16.8.0 and 15.100.0, certain endpoints were vulnerable to time-based and boolean-based blind SQL injection due to insufficient parameter validation, allowing attackers to infer database information. This issue has been fixed in versions 15.100.0 and 16.8.0. | |||||
| CVE-2026-31879 | 1 Frappe | 1 Frappe | 2026-06-17 | N/A | 5.4 MEDIUM |
| Frappe is a full-stack web application framework. Prior to 14.100.2, 15.101.0, and 16.10.0, due to a lack of validation and improper permission checks, users could modify other user's private workspaces. Specially crafted requests could lead to stored XSS here. This vulnerability is fixed in 14.100.2, 15.101.0, and 16.10.0. | |||||
| CVE-2026-31878 | 1 Frappe | 1 Frappe | 2026-06-17 | N/A | 5.0 MEDIUM |
| Frappe is a full-stack web application framework. Prior to 14.100.1, 15.100.0, and 16.6.0, a malicious user could send a crafted request to an endpoint which would lead to the server making an HTTP call to a service of the user's choice. This vulnerability is fixed in 14.100.1, 15.100.0, and 16.6.0. | |||||
| CVE-2026-31877 | 1 Frappe | 1 Frappe | 2026-06-17 | N/A | 9.8 CRITICAL |
| Frappe is a full-stack web application framework. Prior to 15.84.0 and 14.99.0, a specially crafted request made to a certain endpoint could result in SQL injection, allowing an attacker to extract information they wouldn't otherwise be able to. This vulnerability is fixed in 15.84.0 and 14.99.0. | |||||
| CVE-2026-29081 | 1 Frappe | 1 Frappe | 2026-06-17 | N/A | 6.5 MEDIUM |
| Frappe is a full-stack web application framework. Prior to versions 14.100.1 and 15.100.0, an endpoint was vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This issue has been patched in versions 14.100.1 and 15.100.0. | |||||
| CVE-2026-29077 | 1 Frappe | 1 Frappe | 2026-06-17 | N/A | 7.1 HIGH |
| Frappe is a full-stack web application framework. Prior to versions 15.98.0 and 14.100.0, due to a lack of validation when sharing documents, a user could share a document with a permission that they themselves didn't have. This issue has been patched in versions 15.98.0 and 14.100.0. | |||||
| CVE-2026-28436 | 1 Frappe | 1 Frappe | 2026-06-17 | N/A | 7.2 HIGH |
| Frappe is a full-stack web application framework. Prior to versions 16.11.0 and 15.102.0, an attacker can set a crafted image URL that results in XSS when the avatar is displayed, and it can be triggered for other users via website page comments. This issue has been patched in versions 16.11.0 and 15.102.0. | |||||
| CVE-2026-27471 | 1 Frappe | 1 Erpnext | 2026-06-17 | N/A | 9.1 CRITICAL |
| ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 16.6.0, certain endpoints lacked access validation which allowed for unauthorized document access. This issue has been fixed in versions 15.98.1 and 16.6.1. | |||||
| CVE-2026-26977 | 1 Frappe | 1 Learning | 2026-06-17 | N/A | 5.3 MEDIUM |
| Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.44.0 and below, unauthorized users are able to access the details of unpublished courses via API endpoints. A fix for this issue is planned for the 2.45.0 release. | |||||
| CVE-2026-26031 | 1 Frappe | 1 Learning | 2026-06-17 | N/A | 5.3 MEDIUM |
| Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.44.0, security issue was identified in Frappe Learning, where unauthorised users were able to access the full list of enrolled students (by email) in batches. This vulnerability is fixed in 2.44.0. | |||||
| CVE-2026-25956 | 1 Frappe | 1 Frappe | 2026-06-17 | N/A | 6.1 MEDIUM |
| Frappe is a full-stack web application framework. Prior to 14.99.14 and 15.94.0, an attacker could craft a malicious signup URL for a frappe site which could lead to an open redirect (or reflected XSS, depending on the crafted payload) when a user signs up. This vulnerability is fixed in 14.99.14 and 15.94.0. | |||||
| CVE-2026-23497 | 1 Frappe | 1 Learning | 2026-06-17 | N/A | 5.4 MEDIUM |
| Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In 2.44.0 and earlier, there is a stored XSS vulnerability where a specially crafted image filename could execute malicious JavaScript when rendered on course or jobs pages. | |||||
| CVE-2025-68953 | 1 Frappe | 1 Frappe | 2026-06-17 | N/A | 7.5 HIGH |
| Frappe is a full-stack web application framework. Versions 14.99.5 and below and 15.0.0 through 15.80.1 include requests that are vulnerable to path traversal attacks. Arbitrary files from the server could be retrieved due to a lack of proper sanitization on some requests. This issue is fixed in versions 14.99.6 and 15.88.1. To workaround, changing the setup to use a reverse proxy is recommended. | |||||
| CVE-2025-68929 | 1 Frappe | 1 Frappe | 2026-06-17 | N/A | 9.0 CRITICAL |
| Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into accessing a specially crafted link. This could lead to a malicious template being executed on the server, resulting in remote code execution. Versions 14.99.6 and 15.88.1 fix the issue. No known workarounds are available. | |||||
| CVE-2025-68928 | 1 Frappe | 1 Frappe Crm | 2026-06-17 | N/A | 5.4 MEDIUM |
| Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, which were not sanitized, causing cross-site scripting. Version 1.56.2 fixes the issue. No known workarounds are available. | |||||
| CVE-2025-67734 | 1 Frappe | 1 Learning | 2026-06-17 | N/A | 5.4 MEDIUM |
| Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allowed authenticated attackers to enter JavaScript through the Company Website field of the Job Form, exposing users to an XSS attack. The script could then be executed in the browsers of users who opened the malicious job posting. This issue is fixed in version 2.42.0. | |||||