Skip to contentFrappe vulnerabilities
Newest
- frappe erpnextSQL Injection in Frappe's ERPNextCVE-2026-128957.1 High
- frappe lmsFrappe LMS enrollment bypass in paid courses via unrelated batchCVE-2026-393857.1 High
- frappe erpnextERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefixCVE-2026-552428.8 High
- elated-themes frappeFrappe: TarSlip RCE in Package ImportCVE-2026-558528.6 High
- elated-themes frappeFrappe: Path Traversal via /backups RouteCVE-2026-422196.9 Medium
- elated-themes frappeFrappe: Auth. bypass via update_pageCVE-2026-493947.1 High
- elated-themes frappeFrappe: Arbitrary Attachment Injection via add_attachments and upload_fileCVE-2026-481275.3 Medium
- elated-themes frappeFrappe: Possible Path Traversal and Local File Inclusion via Chrome PDF GeneratorCVE-2026-414827.1 High
- elated-themes frappeFrappe: check_safe_sql_query Permits SELECT INTO OUTFILECVE-2026-471992.3 Low
- elated-themes frappeFrappe: Unauthenticated User Enumeration via reset_passwordCVE-2026-585036.9 Medium
- elated-themes frappeFrappe: Unrestricted API access to save_reportCVE-2026-474225.3 Medium
- designthemes lmsWordPress LMS theme <= 9.7 - Reflected Cross Site Scripting (XSS) vulnerabilityCVE-2026-274047.1 High
- frappe frameworkFrappe Framework 17.0.0-dev - Stored XSS in Tree View node label renderingCVE-2026-507124.8 Medium
- frappe frameworkFrappe Framework 17.0.0-dev - Stored XSS in Number Card filter fields renderingCVE-2026-507114.6 Medium
- frappe frameworkFrappe Framework 17.0.0-dev - Stored XSS via eval in Number Card filters_configCVE-2026-507104.6 Medium
- frappe frameworkFrappe Framework 17.0.0-dev - Stored XSS in Notifications Events color renderingCVE-2026-507094.8 Medium
- frappe frameworkFrappe Framework 17.0.0-dev - Stored XSS in Multi Select Dialog result renderingCVE-2026-507084.8 Medium
- frappe frameworkFrappe Framework 17.0.0-dev - Stored XSS in Form Dashboard headline renderingCVE-2026-507054.6 Medium
- frappe frameworkFrappe Framework 17.0.0-dev - Reflected/Stored XSS in File View breadcrumbs renderingCVE-2026-507044.6 Medium
- frappe frameworkFrappe Framework 17.0.0-dev - Stored XSS in Desktop Icon label renderingCVE-2026-507034.8 Medium
- frappe frameworkFrappe Framework 17.0.0-dev - Reflected DOM XSS in dashboard-view breadcrumb renderingCVE-2026-507015.1 Medium
- frappe frameworkFrappe Framework 17.0.0-dev - Stored XSS in frappe.get_avatar image renderingCVE-2026-507004.6 Medium
- frappe frameworkFrappe Framework 17.0.0-dev - Stored XSS in Auto Repeat dashboard schedule renderingCVE-2026-506994.6 Medium
- frappe frameworkFrappe Framework 17.0.0-dev - Stored XSS in Audit Trail template renderingCVE-2026-506984.6 Medium
- frappe lmsReflected XSS in LMSCVE-2026-404572.1 Low
- frappe lmsOS Command Injection in LMSCVE-2026-404568.6 High
- frappe lmsSQL Injection in LMSCVE-2026-404558.6 High
- elated-themes frappeFrappe: Stored XSS in Frappe Report/List View via 'set_link_title_field_value'CVE-2026-535686.9 Medium
- elated-themes frappeFrappe: Lack of permissions checks in 'relink' and 'set_email_password' endpointsCVE-2026-500266.9 Medium
- elated-themes frappeFrappe: Broken Access Control on Private FilesCVE-2026-471825.3 Medium
- elated-themes frappeFrappe: IDOR in update_onboarding_stepCVE-2026-449765.3 Medium
- elated-themes frappeFrappe: Missing authorization on reset form toursCVE-2026-449755.3 Medium
- elated-themes frappeFrappe: DB Schema Enumeration via Frappe-Authorization-SourceCVE-2026-442066.9 Medium
- elated-themes frappeFrappe: Insecure Direct Object Reference for email accountsCVE-2026-442076.9 Medium
- elated-themes frappeFrappe: IDOR in `submit_discussion()`CVE-2026-442086.9 Medium
- elated-themes frappeFrappe: Stored Cross-Site Scripting (XSS) in User Profile through Image UploadCVE-2026-442056.9 Medium
- elated-themes frappeFrappe Vulnerable to Possible SQL Injection via get_blog_listCVE-2026-415816.9 Medium
- elated-themes frappeFrappe: Stored XSS in NoteCVE-2026-477396.9 Medium
- frappe learning, lms +1 moreFrappe LMS: HTML injection in user-controlled metadataCVE-2026-465462.1 Low
- frappe erpnextERPNext 16.16.0 - Stored XSS in POS cart item renderingCVE-2026-428394.8 Medium
- frappe erpnextERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literalsCVE-2026-428405.1 Medium
- epoupon lmsLightweight Music Server 3.76.0 Stored XSS via Media File Metadata TagsCVE-2026-485595.1 Medium
- frappe hrmsFrappe HR: Permission Bypass in HRMS Leave Details APICVE-2026-450816.5 Medium
- frappe lmsFrappe has Path Transversal via SCORMCVE-2026-394059.4 Critical
- elated-themes frappeFrappe has an Arbitrary File Read via Path Traversal in render_includeCVE-2026-393528.7 High
- frappe erpnextERPNext: Unauthorised Document modification due to missing validationCVE-2026-444485.9 Medium
- frappe erpnextERPNext: Possibility of SQL Injection due to missing validationCVE-2026-444478.8 High
- frappe erpnextERPNext: Possibility of SQL Injection due to missing validationCVE-2026-444468.8 High
- frappe erpnextERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI ModuleCVE-2026-444455.3 Medium
- frappe erpnextERPNext: Possible SSRF by any authenticated userCVE-2026-444415.0 Medium
- Show moreLoading…