Skip to contentElated-themes Frappe vulnerabilities
- elated-themes frappeFrappe before 16.35.0 Broken Access Control in File List/Report QueriesCVE-2026-1244435.3 Medium
- elated-themes frappeFrappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File UploadCVE-2026-1191459.4 Critical
- elated-themes frappeFrappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message FieldsCVE-2026-1191448.7 High
- elated-themes frappeFrappe before 16.33.0 Blind SQL Injection via get_eventsCVE-2026-1146647.1 High
- elated-themes frappeFrappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth AuthenticationCVE-2026-1113885.3 Medium
- elated-themes frappeFrappe: Possibility of SQL injection in reportviewCVE-2026-558238.7 High
- elated-themes frappeFrappe: Open Redirect via Unsanitized OAuth State Param.CVE-2026-660575.1 Medium
- elated-themes frappeFrappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkitCVE-2026-1096034.8 Medium
- elated-themes frappeFrappe before v16.31.0 Stored XSS via Dashboard Chart FiltersCVE-2026-1096025.1 Medium
- elated-themes frappeFrappe Framework before v16.30.0 Arbitrary File Read via Outgoing Email HTMLCVE-2026-1096018.2 High
- elated-themes frappeFrappe before 16.31.0 Improper Access Control in Document Follow NotificationsCVE-2026-1096006.9 Medium
- elated-themes frappeFrappe before 15.113.3 Missing Authorization Allows Unauthorized Record ModificationCVE-2026-1095995.3 Medium
- elated-themes frappeFrappe before 16.33.0 Broken Authorization via send_sms EndpointCVE-2026-1095985.3 Medium
- elated-themes frappeFrappe before 15.86.0 LDAP Injection via Unsanitized Endpoint ParametersCVE-2025-714316.3 Medium
- elated-themes frappeFrappe before 15.91.1 Stored XSS via Leaderboard User NamesCVE-2025-714305.1 Medium
- elated-themes frappeFrappe before 15.4.0 XSS via Printview ParametersCVE-2024-583915.3 Medium
- elated-themes frappeFrappe before 15.41.0 Privilege Escalation via Document ActionCVE-2024-583908.7 High
- elated-themes frappeFrappe before 13.46.3 Improper Access Control for Email TemplatesCVE-2023-544127.1 High
- elated-themes frappeFrappe before 13.32.0 Weak Authentication via Print View KeyCVE-2023-544118.2 High
- elated-themes frappeFrappe before 13.22.0 Improper Authorization via Document RenameCVE-2023-544105.3 Medium
- elated-themes frappeFrappe before 13.46.1 XSS via html2text Weak SanitizationCVE-2023-544095.9 Medium
- elated-themes frappeFrappe before 14.31.0 HTML Injection via Weak EscapingCVE-2023-544085.1 Medium
- elated-themes frappeFrappe 14.x before 14.45.0 Information Disclosure via Error Log TracebacksCVE-2023-544076.9 Medium
- elated-themes frappeFrappe before 14.59.0 Safe Execution Flag Bypass in Server ScriptsCVE-2023-544066.9 Medium
- elated-themes frappeFrappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages.CVE-2023-517696.1 Medium
- elated-themes frappeFrappe Framework Development Branch Incorrect Authorization via Jinja Template Preview EndpointCVE-2026-826347.1 High
- elated-themes frappeFrappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link DescriptionCVE-2026-817315.1 Medium
- elated-themes frappeFrappe: Access control bypass via REST API dot-notation fields on linked doctypesCVE-2026-660037.1 High
- elated-themes frappeFrappe: User Enumeration via PDDRCVE-2026-660026.9 Medium
- elated-themes frappeFrappe: Improper Authorization in OAuth2 Consent EndpointCVE-2026-660018.5 High
- elated-themes frappeFrappe: Mass assignment via set_valueCVE-2026-623157.1 High
- elated-themes frappeFrappe: Unauthenticated Workflow approval via confirm_actionCVE-2026-636546.9 Medium
- elated-themes frappeFrappe: Missing authorization in toggle_like and mark_as_seenCVE-2026-535695.3 Medium
- elated-themes frappeFrappe: Unrestricted access to Document Follow APIsCVE-2026-660002.3 Low
- elated-themes frappeFrappe: Unrestricted access to a Document Follow APICVE-2026-660585.3 Medium
- elated-themes frappeFrappe: Field-level permission bypass via Document FollowCVE-2026-660595.3 Medium
- elated-themes frappeFrappe: Stored XSS in Column Headers via Data ImportCVE-2026-493915.1 Medium
- elated-themes frappeFrappe: Lack of Permissions in restore/bulk_restoreCVE-2026-477657.1 High
- elated-themes frappeFrappe: Host header poisoning can redirect magic login links to an attacker-controlled domainCVE-2026-471948.6 High
- elated-themes frappeFrappe Has Broken Access Control in its Workspace Save APICVE-2026-471855.1 Medium
- elated-themes frappeFrappe: TarSlip RCE in Package ImportCVE-2026-558528.6 High
- elated-themes frappeFrappe: Path Traversal via /backups RouteCVE-2026-422196.9 Medium
- elated-themes frappeFrappe: Auth. bypass via update_pageCVE-2026-493947.1 High
- elated-themes frappeFrappe: Arbitrary Attachment Injection via add_attachments and upload_fileCVE-2026-481275.3 Medium
- elated-themes frappeFrappe: Possible Path Traversal and Local File Inclusion via Chrome PDF GeneratorCVE-2026-414827.1 High
- elated-themes frappeFrappe: check_safe_sql_query Permits SELECT INTO OUTFILECVE-2026-471992.3 Low
- elated-themes frappeFrappe: Unauthenticated User Enumeration via reset_passwordCVE-2026-585036.9 Medium
- elated-themes frappeFrappe: Unrestricted API access to save_reportCVE-2026-474225.3 Medium
- elated-themes frappeFrappe: Stored XSS in Frappe Report/List View via 'set_link_title_field_value'CVE-2026-535686.9 Medium
- elated-themes frappeFrappe: Lack of permissions checks in 'relink' and 'set_email_password' endpointsCVE-2026-500266.9 Medium
- Show olderLoading…