Skip to contentElated-themes Frappe vulnerabilities
- elated-themes frappeFrappe: Broken Access Control on Private FilesCVE-2026-471825.3 Medium
- elated-themes frappeFrappe: IDOR in update_onboarding_stepCVE-2026-449765.3 Medium
- elated-themes frappeFrappe: Missing authorization on reset form toursCVE-2026-449755.3 Medium
- elated-themes frappeFrappe: DB Schema Enumeration via Frappe-Authorization-SourceCVE-2026-442066.9 Medium
- elated-themes frappeFrappe: Insecure Direct Object Reference for email accountsCVE-2026-442076.9 Medium
- elated-themes frappeFrappe: IDOR in `submit_discussion()`CVE-2026-442086.9 Medium
- elated-themes frappeFrappe: Stored Cross-Site Scripting (XSS) in User Profile through Image UploadCVE-2026-442056.9 Medium
- elated-themes frappeFrappe Vulnerable to Possible SQL Injection via get_blog_listCVE-2026-415816.9 Medium
- elated-themes frappeFrappe: Stored XSS in NoteCVE-2026-477396.9 Medium
- elated-themes frappeFrappe has an Arbitrary File Read via Path Traversal in render_includeCVE-2026-393528.7 High
- elated-themes frappeFrappe Framework 16.10.0 - Stored DOM XSS in Multiple Field FormattersCVE-2026-38374.6 Medium
- elated-themes frappeFrappe Framework 16.10.0 - Stored DOM XSS in Tag Pill RendererCVE-2026-36734.6 Medium
- elated-themes frappeFrappe allows unrestricted Doctype access via API exploitCVE-2026-393516.9 Medium
- elated-themes frappeFrappe has a SQL injection in bulk_updateCVE-2026-356149.3 Critical
- elated-themes frappeFrappe Workspace modification and stored XSS due to improper resource ownership checksCVE-2026-318795.1 Medium
- elated-themes frappeFrappe: Possible SSRF by any authenticated userCVE-2026-318785.0 Medium
- elated-themes frappeFrappe SQL Injection due to improper field sanitizationCVE-2026-318779.3 Critical
- elated-themes frappeFrappe: Possibility of SQL Injection due to improper fieldname sanitizationCVE-2026-290816.5 Medium
- elated-themes frappeFrappe: Broken Access Control in DocShareCVE-2026-290777.1 High
- elated-themes frappeFrappe: Stored XSS in avatar_macro.htmlCVE-2026-284361.3 Low
- elated-themes frappeFrappe Affected by XSS and Open Redirect in Sign UpCVE-2026-259566.1 Medium
- elated-themes frappe, frappé +1 moreWordPress Frappé theme <= 1.8 - Local File Inclusion vulnerabilityCVE-2025-690838.1 High
- elated-themes frappeCertain Frappe requests are vulnerable to Path TraversalCVE-2025-689537.5 High
- elated-themes frappeFrappe may be vulnerable remote code execution due to server-side template injectionCVE-2025-689299.1 Critical
- elated-themes frappeFrappe vulnerable to a path traversal allowing reading certain filesCVE-2025-662066.8 Medium
- elated-themes frappeFrappe has the possibility of SQL Injection due to improper validationsCVE-2025-662057.1 High
- elated-themes frappeFrappe has an Open Redirect on Login PageCVE-2025-624076.1 Medium
- elated-themes frappeFrappe has potential SQL Injection due to missing validationCVE-2025-583758.1 High
- elated-themes frappeFrappe has the possibility of SQL Injection due to improper validationsCVE-2025-557328.7 High
- elated-themes frappeFrappe has the possibility of Authenticated SQL Injection due to improper validationsCVE-2025-557316.3 Medium
- elated-themes frappeFrappe account takeover via password reset token leakageCVE-2025-528988.7 High
- elated-themes frappeFrappe authenticated XSS via data importCVE-2025-528968.6 High
- elated-themes frappeFrappe possibility of SQL injection due to improper validationsCVE-2025-528958.7 High
- elated-themes frappeFrappe has possibility of SQL injection due to improper validationsCVE-2025-30217Fix available6.6 Medium
- elated-themes frappeFrappe vulnerable to information disclosure leading to account takeoverCVE-2025-30214Fix available8.0 High
- elated-themes frappeFrappe has Possibility of Remote Code Execution due to improper validationCVE-2025-30213Fix available6.3 Medium
- elated-themes frappeFrappe has possibility of SQL injection due to improper validationsCVE-2025-30212Fix available6.6 Medium
- elated-themes frappeFrappe vuilnerable to an open redirect on login pageCVE-2024-340746.1 Medium
- elated-themes frappeFrappe File Permissions can by bypassed using certain endpointsCVE-2024-271058.1 High
- elated-themes frappeFrappe SQL Injection from reporting logicCVE-2024-248137.5 High
- elated-themes frappeFrappe Authenticated Reflected Cross site scripting (XSS) in portal pagesCVE-2024-248125.4 Medium
- elated-themes frappeFrappe vulnerable to HTML injection by any Desk userCVE-2023-46127EPSS 41.3%5.4 Medium
- elated-themes frappePossibility limited SQL injection due to insufficient validation in FrappeCVE-2023-413284.2 Medium
- elated-themes frappeFrappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. This...CVE-2022-417126.5 Medium
- elated-themes frappeFrappe Search navbar_search.html cross site scriptingCVE-2022-39883.5 Low
- frappe erpnext, elated-themes frappe +1 moreERPNext - Improper user access conrolCVE-2022-230555.5 Medium
- frappe erpnext, elated-themes frappe +1 moreERPNext - Stored XSS in My SettingsCVE-2022-230583.5 Low
- frappe erpnext, elated-themes frappe +1 moreERPNext - Stored XSS in My ProfileCVE-2022-230575.4 Medium