Frappe vulnerabilities

Products

• Erpnext 148
• Frappe 111
• Lms 48
• Learning 22
• Hrms 13
• Framework 12
• Crm 6
• Press 6
• Builder 3
• Hr 3
• Crm 2
• Helpdesk 2

Newest

• frappe erpnext Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requests CVE-2026-124316 5.3 MediumNovember 7, 2026
• frappe erpnext Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_items CVE-2026-124315 7.1 HighNovember 7, 2026
• frappe erpnext Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities CVE-2026-124314 7.1 HighNovember 7, 2026
• frappe erpnext Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_payments_for_doc CVE-2026-124313 5.3 MediumNovember 7, 2026
• frappe hrms Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API CVE-2026-121442 5.3 MediumNovember 3, 2026
• frappe lms Frappe LMS allows unpublished certificate access CVE-2026-61806 5.3 MediumOctober 30, 2026
• frappe lms Frappe LMS: Quiz result manipulation and cross-user submission forgery CVE-2026-61805 5.3 MediumOctober 30, 2026
• frappe lms Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount CVE-2026-61803 5.3 MediumOctober 30, 2026
• frappe lms Frappe LMS has Stored XSS in Course Meta CVE-2026-39375 5.1 MediumOctober 30, 2026
• elated-themes frappe Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload CVE-2026-119145 9.4 CriticalOctober 29, 2026
• elated-themes frappe Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields CVE-2026-119144 8.7 HighOctober 29, 2026
• churchcrm crm Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API CVE-2026-116492 7.1 HighOctober 26, 2026
• frappe builder Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect CVE-2026-115720 5.3 MediumOctober 26, 2026
• frappe builder Frappe Builder before 1.36.1 SSRF via convert_to_webp CVE-2026-115717 6.3 MediumOctober 26, 2026
• frappe builder Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt CVE-2026-115718 5.3 MediumOctober 26, 2026
• elated-themes frappe Frappe before 16.33.0 Blind SQL Injection via get_events CVE-2026-114664 7.1 HighOctober 22, 2026
• frappe helpdesk Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation CVE-2026-111939 5.1 MediumOctober 19, 2026
• churchcrm crm Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log CVE-2026-111938 5.3 MediumOctober 19, 2026
• churchcrm crm Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records CVE-2026-111937 5.3 MediumOctober 19, 2026
• chamilo lms Chamilo LMS Ticket TicketManager.php addProject cross site scripting CVE-2026-112031 5.1 MediumOctober 18, 2026
• frappe hrms Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS CVE-2026-64862 6.5 MediumOctober 16, 2026
• frappe hrms Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report CVE-2026-55796 6.5 MediumOctober 16, 2026
• frappe hrms Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation CVE-2026-111389 Public exploit 8.3 HighOctober 16, 2026
• elated-themes frappe Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication CVE-2026-111388 5.3 MediumOctober 16, 2026
• elated-themes frappe Frappe: Possibility of SQL injection in reportview CVE-2026-55823 8.7 HighOctober 13, 2026
• elated-themes frappe Frappe: Open Redirect via Unsanitized OAuth State Param. CVE-2026-66057 5.1 MediumOctober 13, 2026
• frappe suite Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs CVE-2026-109675 5.3 MediumOctober 12, 2026
• frappe erpnext Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation CVE-2026-109674 7.1 HighOctober 12, 2026
• frappe erpnext Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names CVE-2026-109673 8.5 HighOctober 12, 2026
• frappe erpnext ERPNext: Unauthorised access to financial data due to missing validation CVE-2026-108373 6.5 MediumOctober 12, 2026
• frappe erpnext Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data CVE-2026-109672 7.1 HighOctober 12, 2026
• frappe erpnext Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages CVE-2026-109671 8.5 HighOctober 12, 2026
• frappe erpnext Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name CVE-2026-109670 5.1 MediumOctober 12, 2026
• frappe erpnext Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification CVE-2026-109669 5.3 MediumOctober 12, 2026
• frappe erpnext Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints CVE-2026-109668 5.3 MediumOctober 12, 2026
• frappe erpnext Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation CVE-2026-109667 8.7 HighOctober 12, 2026
• frappe erpnext Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints CVE-2026-109666 7.1 HighOctober 12, 2026
• frappe erpnext Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation CVE-2026-109665 5.3 MediumOctober 12, 2026
• frappe erpnext Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification CVE-2026-109664 5.3 MediumOctober 12, 2026
• frappe erpnext Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters CVE-2026-109663 7.1 HighOctober 12, 2026
• frappe erpnext Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form CVE-2026-109662 5.3 MediumOctober 12, 2026
• frappe erpnext Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data CVE-2026-109661 7.1 HighOctober 12, 2026
• frappe erpnext Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints CVE-2026-109660 7.1 HighOctober 12, 2026
• frappe erpnext Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data CVE-2026-109659 7.1 HighOctober 12, 2026
• frappe erpnext Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints CVE-2026-109658 7.1 HighOctober 12, 2026
• frappe erpnext Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name CVE-2026-109657 5.1 MediumOctober 12, 2026
• frappe erpnext Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access CVE-2026-109656 7.1 HighOctober 12, 2026
• frappe erpnext Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints CVE-2026-109655 7.1 HighOctober 12, 2026
• frappe erpnext Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints CVE-2026-109654 5.3 MediumOctober 12, 2026
• frappe erpnext Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover CVE-2026-109653 8.5 HighOctober 12, 2026
• Show olderLoading…