Filtered by vendor Frappe
Subscribe
Total
131 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-31017 | 1 Frappe | 2 Erpnext, Frappe | 2026-07-25 | N/A | 9.1 CRITICAL |
| A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-supplied HTML is insufficiently sanitized before being rendered into PDF. When generating PDFs from user-controlled HTML content, the application allows the inclusion of HTML elements such as <iframe> that reference external resources. The PDF rendering engine automatically fetches these resources on the server side. An attacker can abuse this behavior to force the server to make arbitrary HTTP requests to internal services, including cloud metadata endpoints, potentially leading to sensitive information disclosure. | |||||
| CVE-2026-38432 | 1 Frappe | 1 Erpnext | 2026-07-24 | N/A | 6.1 MEDIUM |
| ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email Template engine. An attacker with permission to create or edit email templates can inject malicious JavaScript code that are executed on the victim's browser when the template is applied. | |||||
| CVE-2026-39351 | 1 Frappe | 1 Frappe | 2026-07-24 | N/A | 9.1 CRITICAL |
| Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe allows unrestricted Doctype access via API exploit. | |||||
| CVE-2026-38431 | 1 Frappe | 1 Erpnext | 2026-07-24 | N/A | 9.8 CRITICAL |
| ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject template expressions that are executed on the server when the template is rendered. | |||||
| CVE-2026-39415 | 1 Frappe | 1 Learning | 2026-07-24 | N/A | 4.3 MEDIUM |
| Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.46.0, a vulnerability has been identified in Frappe Learning where quiz scores can be modified by students before submission. The application currently relies on client-side calculated scores, which can be altered using browser developer tools prior to sending the submission request. While this does not allow modification of other users’ data or privilege escalation, it compromises the integrity of quiz results and undermines academic reliability. This issue affects data integrity but does not expose confidential information or allow unauthorized access to other accounts. This vulnerability is fixed in 2.46.0. | |||||
| CVE-2026-34606 | 1 Frappe | 1 Learning | 2026-07-24 | N/A | 6.1 MEDIUM |
| Frappe Learning Management System (LMS) is a learning system that helps users structure their content. From version 2.27.0 to before version 2.48.0, Frappe LMS was vulnerable to stored XSS. This issue has been patched in version 2.48.0. | |||||
| CVE-2026-46546 | 1 Frappe | 1 Learning | 2026-07-23 | N/A | 5.4 MEDIUM |
| Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.53.0, an authenticated user could supply specially crafted content in certain user-editable fields that, when surfaced in page metadata, caused visitors' browsers to navigate to an attacker-chosen URL. This issue has been patched in version 2.53.0. | |||||
| CVE-2022-28598 | 1 Frappe | 1 Erpnext | 2026-07-09 | N/A | 6.1 MEDIUM |
| Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. | |||||
| CVE-2025-67289 | 1 Frappe | 2 Erpnext, Frappe | 2026-07-05 | N/A | 9.6 CRITICAL |
| An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file. | |||||
| CVE-2026-44448 | 1 Frappe | 1 Erpnext | 2026-06-17 | N/A | 5.9 MEDIUM |
| ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.102.0 and 16.11.0, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 15.102.0 and 16.11.0. | |||||
| CVE-2026-44447 | 1 Frappe | 1 Erpnext | 2026-06-17 | N/A | 8.8 HIGH |
| ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.0, some endpoints were vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This vulnerability is fixed in 16.9.0. | |||||
| CVE-2026-44446 | 1 Frappe | 1 Erpnext | 2026-06-17 | N/A | 8.8 HIGH |
| ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.14.0, some endpoints were vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This vulnerability is fixed in 15.104.3 and 16.14.0. | |||||
| CVE-2026-44445 | 1 Frappe | 1 Erpnext | 2026-06-17 | N/A | 6.5 MEDIUM |
| ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.12.0, an improper restriction of XML external entity (XXE) reference vulnerability in the EDI Module enables an authenticated attacker to read files from the local file system, including sensitive configuration files. This vulnerability is fixed in 15.104.3 and 16.12.0. | |||||
| CVE-2026-44442 | 1 Frappe | 1 Erpnext | 2026-06-17 | N/A | 9.9 CRITICAL |
| ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 16.9.1. | |||||
| CVE-2026-44441 | 1 Frappe | 1 Erpnext | 2026-06-17 | N/A | 5.0 MEDIUM |
| ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.106.0 and 16.16.0, a malicious user could send a crafted request to an endpoint, which would lead to the server making an HTTP call to a service of the user's choice. This vulnerability is fixed in 15.106.0 and 16.16.0. | |||||
| CVE-2026-44440 | 1 Frappe | 1 Erpnext | 2026-06-17 | N/A | 6.5 MEDIUM |
| ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.101.1 and 16.10.0, an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability on an endpoint allows an authenticated adjacent attacker to read arbitrary files. This vulnerability is fixed in 15.101.1 and 16.10.0. | |||||
| CVE-2026-41430 | 1 Frappe | 1 Press | 2026-06-17 | N/A | 6.1 MEDIUM |
| Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Redirect parameter on login page is vulnerable to reflected XSS. The patch in commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 fixes the issue by restricting redirects to internal URLs only. | |||||
| CVE-2026-41320 | 1 Frappe | 1 Frappe Hr | 2026-06-17 | N/A | 6.5 MEDIUM |
| Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.54.0 and 14.38.1, a specially crafted request made to a certain endpoint could result in SQL injection, allowing an attacker to extract information they wouldn't otherwise be able to. Versions 15.54.0 and 14.38.1 contain a patch. No known workarounds are available. | |||||
| CVE-2026-41317 | 1 Frappe | 1 Press | 2026-06-17 | N/A | 7.5 HIGH |
| Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS).`press.api.account.create_api_secret` is prone to CSRF-like exploits. This endpoint writes to database and it is also accessible via GET method. The patch in commit 52ea2f2d1b587be0807557e96f025f47897d00fd restricts method to POST. | |||||
| CVE-2026-40889 | 1 Frappe | 1 Frappe Hr | 2026-06-17 | N/A | 6.5 MEDIUM |
| Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.2 and 16.4.2, authenticated users can access unauthorized files by exploiting certain api endpoint. Versions 15.58.2 and 16.4.2 contain a patch. No known workarounds are available. | |||||