Skip to contentFrappe vulnerabilities
Newest
- frappe erpnextERPNext: Path Traversal Leading to Sensitive File ExposureCVE-2026-444406.5 Medium
- frappe erpnextERPNext: Unauthorised Document modification due to missing validationCVE-2026-444429.9 Critical
- frappe erpnext, erpnext frappe framework (erpnext), frappe technologies framework (erpnext) +2 moreFrappe Framework ERPNext 13.4.0 Remote Code ExecutionCVE-2023-543458.7 High
- frappe erpnextERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email Template...CVE-2026-384326.1 Medium
- frappe erpnextERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker...CVE-2026-384319.8 Critical
- frappe pressPress vulnerable to reflected XSS on login redirectionCVE-2026-414301.3 Low
- frappe pressFrappe Press has an unsafe HTTP method / CSRF-adjacent issue on API secret generationCVE-2026-413176.6 Medium
- elated-themes frappeFrappe Framework 16.10.0 - Stored DOM XSS in Multiple Field FormattersCVE-2026-38374.6 Medium
- elated-themes frappeFrappe Framework 16.10.0 - Stored DOM XSS in Tag Pill RendererCVE-2026-36734.6 Medium
- frappe hr, hrms +1 moreFrappe HR has possibility of SQL Injection due to improper field sanitizationCVE-2026-413206.5 Medium
- frappe hr, hrms +1 moreFrappe HR has Improper Access Control on FilesCVE-2026-408896.5 Medium
- frappe hr, hrms +1 moreFrappe HR vulnerable to Improper Access ControlCVE-2026-408886.5 Medium
- frappe learning, lms +1 moreFrappe Learning Management System has Client-Side Manipulation of Quiz ScoresCVE-2026-394155.3 Medium
- frappe erpnext, frappe +1 moreA Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of...CVE-2026-310179.1 Critical
- elated-themes frappeFrappe allows unrestricted Doctype access via API exploitCVE-2026-393516.9 Medium
- elated-themes frappeFrappe has a SQL injection in bulk_updateCVE-2026-356149.3 Critical
- frappe learning, lms +1 moreStored XSS in Frappe LMSCVE-2026-346066.9 Medium
- frappe erpnextERP has a possibility SQL Injection vulnerability due to missing validationCVE-2026-329547.1 High
- elated-themes frappeFrappe Workspace modification and stored XSS due to improper resource ownership checksCVE-2026-318795.1 Medium
- elated-themes frappeFrappe: Possible SSRF by any authenticated userCVE-2026-318785.0 Medium
- elated-themes frappeFrappe SQL Injection due to improper field sanitizationCVE-2026-318779.3 Critical
- elated-themes frappeFrappe: Possibility of SQL Injection due to improper fieldname sanitizationCVE-2026-290816.5 Medium
- elated-themes frappeFrappe: Broken Access Control in DocShareCVE-2026-290777.1 High
- elated-themes frappeFrappe: Stored XSS in avatar_macro.htmlCVE-2026-284361.3 Low
- frappe erpnextERP: Document access through endpoints due to missing validationCVE-2026-274719.3 Critical
- frappe learning, lms +1 moreFrappe Learning Management System exposes details of unpublished courses to unauthorized usersCVE-2026-269776.9 Medium
- frappe learning, lms +1 moreFrappe LMS affected by unauthorised user was able to access the full list of batch enrolled studentsCVE-2026-260311.3 Low
- elated-themes frappeFrappe Affected by XSS and Open Redirect in Sign UpCVE-2026-259566.1 Medium
- frappe erpnextERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks...CVE-2025-659244.1 Medium
- frappe erpnextA Stored Cross-Site Scripting (XSS) vulnerability was discovered within the CSV import mechanism...CVE-2025-659235.4 Medium
- frappe hrmspbrong hrms recruitment.go UpdateRecruitmentById cross site scriptingCVE-2026-11615.1 Medium
- chamilo lmsChamilo LMS Legal Consent SocialController.php deleteLegal improper authorizationCVE-2026-11065.3 Medium
- frappe learning, lms +1 moreFrappe LMS has a Stored XSS via Unsanitized Image Filename in Course and Jobs PagesCVE-2026-234971.3 Low
- elated-themes frappeCertain Frappe requests are vulnerable to Path TraversalCVE-2025-689537.5 High
- elated-themes frappeFrappe may be vulnerable remote code execution due to server-side template injectionCVE-2025-689299.1 Critical
- churchcrm crmFrappe CRM vulnerable to authenticated XSS via website fieldCVE-2025-689285.4 Medium
- frappe, frappe erpnext +1 moreAn arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0...CVE-2025-672899.6 Critical
- frappe erpnextAn issue was discovered in Frappe ERPNext through 15.89.0. Function...CVE-2025-664408.8 High
- frappe erpnextAn issue was discovered in Frappe ERPNext through 15.89.0. Function...CVE-2025-664398.8 High
- frappe erpnextA Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89...CVE-2025-664388.8 High
- frappe erpnextAn SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method...CVE-2025-664378.8 High
- frappe erpnextAn SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions...CVE-2025-664364.3 Medium
- frappe erpnextAn SSTI (Server-Side Template Injection) vulnerability exists in the get_contract_template method...CVE-2025-664354.3 Medium
- frappe erpnextAn SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text...CVE-2025-664348.8 High
- frappe learning, lms +1 moreFrappe Authenticated Users can Execute JavaScript through its Job FormCVE-2025-677345.1 Medium
- frappe learning, lms +1 moreFrappe authenticated users can execute XSS through form description fieldsCVE-2025-67730Public exploit5.1 Medium
- frappe helpdeskFrappe Helpdesk 1.14.0 — SQL Injection in dashboard get_dashboard_dataCVE-2025-106558.6 High
- frappe learning, lms +1 moreFrappe LMS is Missing Server-Side Authorization in Business LogicCVE-2025-665811.3 Low
- frappe erpnext, frappe +1 moreIn ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar...CVE-2025-652679.0 Critical
- elated-themes frappeFrappe vulnerable to a path traversal allowing reading certain filesCVE-2025-662066.8 Medium
- Show moreLoading…