Vulnerabilities

TI-2026-56379 CVE-2026-81731 · GHSA-8fp2-5hmm-fgqh

Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description

LOW 23

Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00302 Published 2026-08-27 No fix listed CWE-79

TI-2026-03323 CVE-2026-3837 · GHSA-fgxh-7qw6-7wg3

Frappe Framework 16.10.0 - Stored DOM XSS in Multiple Field Formatters

LOW 21

An authenticated attacker can persist crafted values in multiple field types and trigger client-side script execution when another user opens the affected document in Desk.

CVSS 4.0MEDIUM 4.6 Network High privileges User interaction EPSS 0.00193 Published 2026-04-22 No fix listed CWE-79

TI-2026-03168 CVE-2026-3673 · GHSA-qg6x-fw6m-9qrp

Frappe Framework 16.10.0 - Stored DOM XSS in Tag Pill Renderer

MEDIUM 54

An authenticated attacker can store a crafted tag value in _user_tags and trigger JavaScript execution when a victim opens the list/report view where tags are rendered.

CVSS 4.0MEDIUM 4.6 Network High privileges User interaction EPSS 0.00201 Published 2026-04-22 No fix listed CWE-79

TI-2026-23822 CVE-2026-31017 · GHSA-2vgp-8568-m98f

A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format…

MEDIUM 47

A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-supplied HTML is insufficiently sanitized before being rendered into…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00245 Published 2026-04-08 No fix listed CWE-918

TI-2026-28339 CVE-2026-39351

Frappe allows unrestricted Doctype access via API exploit

LOW 38

Frappe is a full-stack web application framework.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00262 Published 2026-04-07 Fixed in 15.104.0, 16.14.0 CWE-862

TI-2026-27715 CVE-2026-35614

Frappe has a SQL injection in bulk_update

MEDIUM 48

Frappe is a full-stack web application framework.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.0027 Published 2026-04-07 Fixed in 15.104.0, 16.14.0 CWE-89

TI-2026-24431 CVE-2026-31879

Frappe Workspace modification and stored XSS due to improper resource ownership checks

LOW 22

Frappe is a full-stack web application framework.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00162 Published 2026-03-11 Fixed in 16.10.0 CWE-79

TI-2026-24430 CVE-2026-31878

Frappe: Possible SSRF by any authenticated user

LOW 22

Frappe is a full-stack web application framework.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00213 Published 2026-03-11 Fixed in 16.6.0, 15.100.0 +1 CWE-918

TI-2026-24429 CVE-2026-31877

Frappe SQL Injection due to improper field sanitization

MEDIUM 42

Frappe is a full-stack web application framework.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00324 Published 2026-03-11 Fixed in 15.84.0, 14.99.0 CWE-89

TI-2026-23226 CVE-2026-29081

Frappe: Possibility of SQL Injection due to improper fieldname sanitization

LOW 38

Frappe is a full-stack web application framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0031 Published 2026-03-05 Fixed in 15.100.0, 14.100.1 CWE-89

TI-2026-23222 CVE-2026-29077

Frappe: Broken Access Control in DocShare

LOW 31

Frappe is a full-stack web application framework.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00219 Published 2026-03-05 Fixed in 15.98.0, 14.100.0 CWE-284

TI-2026-22710 CVE-2026-28436

Frappe: Stored XSS in avatar_macro.html

LOW 13

Frappe is a full-stack web application framework.

CVSS 4.0LOW 1.3 Network No auth User interaction EPSS 0.00192 Published 2026-03-05 Fixed in 16.11.0, 15.102.0 CWE-79

TI-2026-20981 CVE-2026-25956

Frappe Affected by XSS and Open Redirect in Sign Up

LOW 27

Frappe is a full-stack web application framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00194 Published 2026-02-10 Fixed in 14.99.14, 15.94.0 CWE-601

TI-2025-42409 CVE-2025-68953

Certain Frappe requests are vulnerable to Path Traversal

LOW 39

Frappe is a full-stack web application framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00428 Published 2026-01-05 Fixed in 14.99.6, 15.88.1 CWE-22

TI-2025-42385 CVE-2025-68929

Frappe may be vulnerable remote code execution due to server-side template injection

MEDIUM 48

Frappe is a full-stack web application framework.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.005 Published 2025-12-29 Fixed in 14.99.6, 15.88.1 CWE-1336

TI-2025-41184 CVE-2025-67289 · GHSA-9924-rxm2-pj79

An arbitrary file upload vulnerability in the Attachments module of Frappe Framework…

MEDIUM 43

An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00463 Published 2025-12-22 No fix listed CWE-434

TI-2025-40308 CVE-2025-65267 · GHSA-33qr-xp8v-vv64

In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG…

MEDIUM 41

In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00372 Published 2025-12-03 No fix listed CWE-79

TI-2025-40710 CVE-2025-66206

Frappe vulnerable to a path traversal allowing reading certain files

LOW 37

Frappe is a full-stack web application framework.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00365 Published 2025-12-01 Fixed in 15.86.0, 14.99.2 CWE-22

TI-2025-40709 CVE-2025-66205

Frappe has the possibility of SQL Injection due to improper validations

MEDIUM 43

Frappe is a full-stack web application framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00333 Published 2025-12-01 Fixed in 15.86.0, 14.99.2 CWE-89

TI-2025-38674 CVE-2025-62407

Frappe has an Open Redirect on Login Page

LOW 27

Frappe is a full-stack web application framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00263 Published 2025-10-16 Fixed in 15.83.0, 14.98.0 CWE-601

TI-2025-35319 CVE-2025-56381 · GHSA-899m-3xff-2xg9

ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the…

HIGH 70

ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the order_by and group_by parameters.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00314 Published 2025-10-02 No fix listed CWE-89

TI-2025-35318 CVE-2025-56380 · GHSA-g57q-w988-8hv8

Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the…

HIGH 70

Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value API endpoint and a crafted script to the fieldname parameter

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00314 Published 2025-10-02 No fix listed CWE-89

TI-2025-35317 CVE-2025-56379 · GHSA-5wvf-mfpw-266p

A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT…

MEDIUM 58

A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the content field.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00419 Published 2025-10-02 No fix listed CWE-79

TI-2025-32467 CVE-2025-52048

In Frappe 15.x.x before 15.72.0 and 14.x.x before 14.96.10, in the function add_tag() at…

LOW 36

In Frappe 15.x.x before 15.72.0 and 14.x.x before 14.96.10, in the function add_tag() at `frappe/desk/doctype/tag/tag.py` is vulnerable to SQL Injection, which allows an attacker to extract information from databases by…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00263 Published 2025-09-15 No fix listed CWE-89

TI-2025-35153 CVE-2025-55732

Frappe has the possibility of SQL Injection due to improper validations

MEDIUM 40

Frappe is a full-stack web application framework.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00341 Published 2025-08-20 Fixed in 15.74.2, 14.96.15 CWE-89

Vulnerabilities

Filters