Skip to contentFrappe vulnerabilities
Newest
- elated-themes frappeFrappe has the possibility of SQL Injection due to improper validationsCVE-2025-662057.1 High
- frappe crmFrappe CRM 1.53.1 — Multiple SQL Injections in Dashboard ControllerCVE-2025-114617.1 High
- frappe learning, lms +1 moreFrappe LMS revoking access did not show immediate effect as roles were cachedCVE-2025-647071.2 Low
- frappe learning, lms +1 moreFrappe user was able to access the submission of other studentsCVE-2025-647051.3 Low
- frappe learning, lms +1 moreFrappe Learning users were able to add HTML through input fields in the Job FormCVE-2025-627791.2 Low
- frappe learning, lms +1 moreFrappe Learning allowed students to access the Quiz Form via direct URLCVE-2025-627781.3 Low
- elated-themes frappeFrappe has an Open Redirect on Login PageCVE-2025-624076.1 Medium
- frappe learning, lms +1 moreFrappe had attachments made by students to their assignments of type Text set to publicCVE-2025-621582.7 Low
- frappe lms, learning +1 moreFrappe LMS Course cross site scriptingCVE-2025-112834.8 Medium
- frappe lms, learning +1 moreFrappe LMS Unpublished Course courses access controlCVE-2025-112812.3 Low
- frappe lms, learning +1 moreFrappe LMS Assignment Picture files direct requestCVE-2025-112806.3 Medium
- frappe erpnext, frappe +1 moreERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api...CVE-2025-56381Public exploit6.5 Medium
- frappe, frappe erpnext +1 moreFrappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the...CVE-2025-56380Public exploit6.5 Medium
- frappe erpnext, frappe +1 moreA stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0...CVE-2025-56379Public exploit5.4 Medium
- frappe erpnextIn Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype...CVE-2025-520428.2 High
- frappe erpnextIn Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype...CVE-2025-520418.2 High
- frappe erpnextIn Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker can extract all information from databases by in…CVE-2025-520408.2 High
- frappe erpnextIn Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext...CVE-2025-520398.2 High
- frappe erpnextIn Frappe ERPNext 15.57.5, the function get_loyalty_program_details_with_points() at erpnext...CVE-2025-520506.5 Medium
- frappe erpnextIn Frappe ErpNext v15.57.5, the function get_timesheet_detail_rate() at erpnext/projects/doctype...CVE-2025-520496.5 Medium
- frappe erpnextIn Frappe ErpNext v15.57.5, the function get_income_account() at erpnext/controllers/queries.py...CVE-2025-520476.5 Medium
- frappe erpnextIn Frappe ERPNext v15.57.5, the function import_coa() at erpnext/accounts/doctype...CVE-2025-520436.5 Medium
- frappe pressPress vulnerable to email flooding to users due to lack of validation and rate limitsCVE-2025-594212.7 Low
- frappe learning, lms +1 moreFrappe Learning vulnerable to Malicious Content upload via Profile bio fieldCVE-2025-594154.6 Medium
- frappe erpnextIn Frappe ERPNext v15.57.5, the function get_stock_balance() at erpnext/stock/utils.py is...CVE-2025-520447.5 High
- frappe erpnextERP: Possibility of SQL injection due to missing validationCVE-2025-584398.1 High
- elated-themes frappeFrappe has potential SQL Injection due to missing validationCVE-2025-583758.1 High
- frappeFrappe has potential SQL Injection due to missing validationCVE-2025-520486.5 Medium
- elated-themes frappeFrappe has the possibility of SQL Injection due to improper validationsCVE-2025-557328.7 High
- elated-themes frappeFrappe has the possibility of Authenticated SQL Injection due to improper validationsCVE-2025-557316.3 Medium
- frappe lms, learning +1 moreFrappe LMS Incomplete Fix CVE-2025-55006 cross site scriptingCVE-2025-112824.8 Medium
- frappe learning, lms +1 moreFrappe Learning Holds Potential for Malicious SVG Upload in Image Upload FeatureCVE-2025-550064.3 Medium
- frappe pressPress has a potential 2FA bypassCVE-2025-535456.9 Medium
- designthemes lmsWordPress LMS theme <= 9.2 - SQL Injection VulnerabilityCVE-2025-528339.3 Critical
- elated-themes frappeFrappe account takeover via password reset token leakageCVE-2025-528988.7 High
- elated-themes frappeFrappe authenticated XSS via data importCVE-2025-528968.6 High
- elated-themes frappeFrappe possibility of SQL injection due to improper validationsCVE-2025-528958.7 High
- designthemes lmsWordPress LMS theme <= 9.2 - Reflected Cross Site Scripting (XSS) VulnerabilityCVE-2025-527997.1 High
- frappe erpnextA Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3....CVE-2025-28062Public exploit8.1 High
- elated-themes frappeFrappe has possibility of SQL injection due to improper validationsCVE-2025-30217Fix available6.6 Medium
- elated-themes frappeFrappe vulnerable to information disclosure leading to account takeoverCVE-2025-30214Fix available8.0 High
- elated-themes frappeFrappe has Possibility of Remote Code Execution due to improper validationCVE-2025-30213Fix available6.3 Medium
- elated-themes frappeFrappe has possibility of SQL injection due to improper validationsCVE-2025-30212Fix available6.6 Medium
- frappe hrmspbrong hrms resource.go HrmsDB improper authorizationCVE-2025-18156.9 Medium
- frappe lmsVIWIS LMS File Upload cross site scriptingCVE-2024-80026.9 Medium
- frappe lms, viwis learning management system +1 moreVIWIS LMS Print authorizationCVE-2024-80016.9 Medium
- frappe pressPress has a potential 2FA bypassCVE-2024-503560.0 None
- frappe pressFrappe Press possible HTML injection through SaaS Signup inputsCVE-2024-497511.2 Low
- elated-themes frappeFrappe vuilnerable to an open redirect on login pageCVE-2024-340746.1 Medium
- frappe lms, totara enterprise lms +1 moreTotara LMS User Selector cross-site request forgeryCVE-2024-39322.3 Low
- Show moreLoading…