Priority HIGH 70
ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the order_by and group_by parameters.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00314 · Published 2025-10-02 · No fix listed CWE-89
Priority HIGH 70
Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value API endpoint and a crafted script to the fieldname parameter
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00314 · Published 2025-10-02 · No fix listed CWE-89
Priority MEDIUM 62
Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00979 · Published 2022-11-25 · No fix listed CWE-22
Priority MEDIUM 58
A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the content field.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00419 · Published 2025-10-02 · No fix listed CWE-79
Priority MEDIUM 54
An authenticated attacker can store a crafted tag value in _user_tags and trigger JavaScript execution when a victim opens the list/report view where tags are rendered.
CVSS 4.0MEDIUM 4.6· Network · High privileges · User interaction · EPSS 0.00201 · Published 2026-04-22 · No fix listed CWE-79
Priority MEDIUM 52
Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.41264 · Published 2023-10-23 · Fixed in 14.49.0 CWE-79
Priority MEDIUM 48
Frappe is a full-stack web application framework.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.0027 · Published 2026-04-07 · Fixed in 15.104.0, 16.14.0 CWE-89
Priority MEDIUM 48
Frappe is a full-stack web application framework.
CVSS 3.1CRITICAL 9.1· Network · Low privileges · User interaction · EPSS 0.005 · Published 2025-12-29 · Fixed in 14.99.6, 15.88.1 CWE-1336
Priority MEDIUM 47
A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-supplied HTML is insufficiently sanitized before being rendered into…
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00245 · Published 2026-04-08 · No fix listed CWE-918
Priority MEDIUM 47
An issue was discovered in Frappe Framework 10 through 12 before 12.0.4.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02573 · Published 2019-08-12 · No fix listed CWE-94
Priority MEDIUM 45
Frappe is a full-stack web application framework.
CVSS 4.0HIGH 8.6· Network · Low privileges · No interaction · EPSS 0.0029 · Published 2025-06-30 · Fixed in 15.57.0, 14.94.2 CWE-79
Priority MEDIUM 43
An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.00463 · Published 2025-12-22 · No fix listed CWE-434
Priority MEDIUM 43
Frappe is a full-stack web application framework.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00333 · Published 2025-12-01 · Fixed in 15.86.0, 14.99.2 CWE-89
Priority MEDIUM 43
Frappe is a full-stack web application framework.
CVSS 4.0HIGH 8.0· Network · No auth · No interaction · EPSS 0.00415 · Published 2025-03-25 · Fixed in 14.89.0, 15.51.0 CWE-200
Priority MEDIUM 42
Frappe is a full-stack web application framework.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00324 · Published 2026-03-11 · Fixed in 15.84.0, 14.99.0 CWE-89
Priority MEDIUM 41
In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript.
CVSS 3.1CRITICAL 9.0· Network · Low privileges · User interaction · EPSS 0.00372 · Published 2025-12-03 · No fix listed CWE-79
Priority MEDIUM 41
An issue was discovered in Frappe Framework 10 through 12 before 12.0.4.
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0168 · Published 2019-08-12 · No fix listed CWE-89
Priority MEDIUM 40
Frappe is a full-stack web application framework.
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.00341 · Published 2025-08-20 · Fixed in 15.74.2, 14.96.15 CWE-89
Priority MEDIUM 40
Frappe is a full-stack web application framework.
CVSS 4.0HIGH 8.7· Network · No auth · User interaction · EPSS 0.00446 · Published 2025-06-30 · Fixed in 15.58.0, 14.94.3 CWE-200
Priority MEDIUM 40
Frappe is a full-stack web application framework.
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.00432 · Published 2025-06-30 · Fixed in 15.58.0, 14.94.3 CWE-89
Priority MEDIUM 40
Frappe is a full-stack web application framework.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00646 · Published 2024-03-20 · Fixed in 14.64.0 CWE-89
Priority MEDIUM 40
[ERPNext][Frappe Version <= 7.1.27] SQL injection vulnerability in frappe.share.get_users allows remote authenticated users to execute arbitrary SQL commands via the fields parameter.
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0112 · Published 2017-10-04 · No fix listed CWE-89
Priority LOW 39
Frappe is a full-stack web application framework.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00428 · Published 2026-01-05 · Fixed in 14.99.6, 15.88.1 CWE-22
Priority LOW 38
Frappe is a full-stack web application framework.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00262 · Published 2026-04-07 · Fixed in 15.104.0, 16.14.0 CWE-862
Priority LOW 38
Frappe is a full-stack web application framework.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0031 · Published 2026-03-05 · Fixed in 15.100.0, 14.100.1 CWE-89
Load more
THREATIST.IORead the docs