Skip to contentFrappe vulnerabilities
Newest
- frappe lms, totara, totara enterprise lms +2 moreTotara LMS User Selector check.php cross site scriptingCVE-2024-39315.1 Medium
- elated-themes frappeFrappe File Permissions can by bypassed using certain endpointsCVE-2024-271058.1 High
- elated-themes frappeFrappe SQL Injection from reporting logicCVE-2024-248137.5 High
- frappe lms, moodle +1 moreInadequate access control vulnerability in MoodleCVE-2024-1439Fix available6.5 Medium
- elated-themes frappeFrappe Authenticated Reflected Cross site scripting (XSS) in portal pagesCVE-2024-248125.4 Medium
- elated-themes frappeFrappe vulnerable to HTML injection by any Desk userCVE-2023-46127EPSS 41.3%5.4 Medium
- frappe frappe/lms, learning +1 moreCross-site Scripting (XSS) - Generic in frappe/lmsCVE-2023-55557.1 High
- frappe learning, lms +1 moreFrappe LMS SQL Injection Issue on People PageCVE-2023-428076.3 Medium
- academy lms, creativeitem academy lms +1 moreAcademy LMS GET Parameter filter sql injectionCVE-2023-49746.3 Medium
- academy lms, creativeitem academy lms +1 moreAcademy LMS GET Parameter filter cross site scriptingCVE-2023-49733.5 Low
- elated-themes frappePossibility limited SQL injection due to insufficient validation in FrappeCVE-2023-413284.2 Medium
- academy lms, creativeitem academy lms +1 moreAcademy LMS courses cross site scriptingCVE-2023-4119Public exploit4.3 Medium
- fernus informatics lms, fernus learning management systems +1 moreUnrestricted Upload of File with Dangerous Type in Fernus LMSCVE-2023-17289.8 Critical
- elated-themes frappeFrappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. This...CVE-2022-417126.5 Medium
- elated-themes frappeFrappe Search navbar_search.html cross site scriptingCVE-2022-39883.5 Low
- frappe erpnextFrappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly...CVE-2022-28598Public exploit6.1 Medium
- frappe erpnext, elated-themes frappe +1 moreERPNext - Improper user access conrolCVE-2022-230555.5 Medium
- frappe erpnext, elated-themes frappe +1 moreERPNext - Stored XSS in My SettingsCVE-2022-230583.5 Low
- erpnextERPNext - Stored XSS leads to account takoverCVE-2022-230563.5 Low
- frappe erpnext, elated-themes frappe +1 moreERPNext - Stored XSS in My ProfileCVE-2022-230575.4 Medium
- frappeFrappe Framework 12 and 13 does not properly validate the HTTP method for the frappe.client API.CVE-2020-351755.3 Medium
- frappeIn two-factor authentication, the system also sending 2fa secret key in response, which enables...CVE-2020-275087.5 High
- frappe erpnextAn SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext...CVE-2020-61456.4 Medium
- frappe erpnextERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI.CVE-2019-205217.4 High
- frappe erpnextERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI.CVE-2019-205207.4 High
- frappe erpnextERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a...CVE-2019-205197.4 High
- frappe erpnextERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI.CVE-2019-205187.4 High
- frappe erpnextERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI.CVE-2019-205177.4 High
- frappe erpnextERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI.CVE-2019-205167.4 High
- frappe erpnextERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI.CVE-2019-205157.4 High
- frappe erpnextERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI.CVE-2019-205147.4 High
- frappe erpnextERPNext 11.1.47 allows blog?blog_category= Frame Injection.CVE-2019-205114.7 Medium
- frappeIn core/doctype/prepared_report/prepared_report.py in Frappe 11 and 12, data files generated with...CVE-2019-205297.5 High
- frappepublic/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape...CVE-2019-157006.1 Medium
- frappeAn issue was discovered in Frappe Framework 10 through 12 before 12.0.4. A server side template...CVE-2019-149659.8 Critical
- frappeAn issue was discovered in Frappe Framework 10 through 12 before 12.0.4. There exists an...CVE-2019-149668.8 High
- frappeAn issue was discovered in Frappe Framework 10, 11 before 11.1.46, and 12. There exists an XSS...CVE-2019-149676.1 Medium
- frappe erpnextA SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack...CVE-2018-200617.5 High
- frappe erpnextAn exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6....CVE-2018-38855.4 Medium
- frappe erpnextAn exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6....CVE-2018-38845.4 Medium
- frappe erpnextAn exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6....CVE-2018-38835.4 Medium
- frappe erpnextAn exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6....CVE-2018-38825.4 Medium
- frappe erpnextAn XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment.CVE-2018-11339Public exploit6.1 Medium
- frappe[ERPNext][Frappe Version <= 7.1.27] SQL injection vulnerability in frappe.share.get_users allows...CVE-2017-10001208.8 High