Skip to contentFrappe vulnerabilities
Newest
- frappe erpnextFrappe ERPNext before 15.83.0 Reflected XSS Leading to Account TakeoverCVE-2025-714328.6 High
- elated-themes frappeFrappe before 15.86.0 LDAP Injection via Unsanitized Endpoint ParametersCVE-2025-714316.3 Medium
- elated-themes frappeFrappe before 15.91.1 Stored XSS via Leaderboard User NamesCVE-2025-714305.1 Medium
- elated-themes frappeFrappe before 15.4.0 XSS via Printview ParametersCVE-2024-583915.3 Medium
- elated-themes frappeFrappe before 15.41.0 Privilege Escalation via Document ActionCVE-2024-583908.7 High
- elated-themes frappeFrappe before 13.46.3 Improper Access Control for Email TemplatesCVE-2023-544127.1 High
- elated-themes frappeFrappe before 13.32.0 Weak Authentication via Print View KeyCVE-2023-544118.2 High
- elated-themes frappeFrappe before 13.22.0 Improper Authorization via Document RenameCVE-2023-544105.3 Medium
- elated-themes frappeFrappe before 13.46.1 XSS via html2text Weak SanitizationCVE-2023-544095.9 Medium
- elated-themes frappeFrappe before 14.31.0 HTML Injection via Weak EscapingCVE-2023-544085.1 Medium
- elated-themes frappeFrappe 14.x before 14.45.0 Information Disclosure via Error Log TracebacksCVE-2023-544076.9 Medium
- elated-themes frappeFrappe before 14.59.0 Safe Execution Flag Bypass in Server ScriptsCVE-2023-544066.9 Medium
- frappe erpnextERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup MethodsCVE-2026-1093775.3 Medium
- frappe erpnextERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_htmlCVE-2026-1093765.3 Medium
- churchcrm crmFrappe CRM 1.49.0 through 1.87.0 Missing Authorization via get_linked_docs_of_documentCVE-2026-1087345.3 Medium
- frappe hrmsFrappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocationCVE-2026-1087335.3 Medium
- frappe hrmsFrappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amountCVE-2026-1087325.3 Medium
- designthemes lmsWordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-785327.1 High
- bradwenqiang hrFrappe HR Permission Validation __init__.py get_attendance_requests authorizationCVE-2026-1010065.3 Medium
- forma lmsForma LMS Multi-User-Selector AJAX Endpoint getData getDataTask sql injectionCVE-2026-967775.3 Medium
- frappe erpnextFrappe ERPNext before 16.34.1 Unauthorized Method InvocationCVE-2026-966725.3 Medium
- frappe erpnextFrappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet EndpointsCVE-2026-941137.1 High
- frappe lmsFrappe LMS: Path Traversal in SCORM File ServingCVE-2026-543438.7 High
- frappe hrmsFrappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode ReportCVE-2026-545247.1 High
- elated-themes frappeFrappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages.CVE-2023-517696.1 Medium
- churchcrm crmFrappe CRM: Authentication Bypass via Logged Invitation Keys in crm/apiCVE-2026-537618.2 High
- elated-themes frappeFrappe Framework Development Branch Incorrect Authorization via Jinja Template Preview EndpointCVE-2026-826347.1 High
- elated-themes frappeFrappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link DescriptionCVE-2026-817315.1 Medium
- elated-themes frappeFrappe: Access control bypass via REST API dot-notation fields on linked doctypesCVE-2026-660037.1 High
- elated-themes frappeFrappe: User Enumeration via PDDRCVE-2026-660026.9 Medium
- elated-themes frappeFrappe: Improper Authorization in OAuth2 Consent EndpointCVE-2026-660018.5 High
- elated-themes frappeFrappe: Mass assignment via set_valueCVE-2026-623157.1 High
- elated-themes frappeFrappe: Unauthenticated Workflow approval via confirm_actionCVE-2026-636546.9 Medium
- elated-themes frappeFrappe: Missing authorization in toggle_like and mark_as_seenCVE-2026-535695.3 Medium
- frappe erpnextERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filterCVE-2026-658227.6 High
- frappe erpnextERPNext: Server-Side Template Injection leading to Remote Code ExecutionCVE-2026-659749.9 Critical
- frappe erpnextERPNext: Possibility of server-side template injection due to missing validationCVE-2026-729119.9 Critical
- frappe erpnextERPNext: Unauthorised modification of master data due to missing validationCVE-2026-729107.1 High
- frappe erpnextERPNext: Broken Access Control on certain endpointsCVE-2026-729097.1 High
- frappe erpnextERPNext: Possibility of SQL injection due to missing validationCVE-2026-729086.5 Medium
- frappe erpnextERPNext: Broken Access Control on certain endpointCVE-2026-729076.5 Medium
- frappe erpnextERPNext: Unauthorised triggering of automated emails due to missing validationCVE-2026-729064.3 Medium
- elated-themes frappeFrappe: Unrestricted access to Document Follow APIsCVE-2026-660002.3 Low
- elated-themes frappeFrappe: Unrestricted access to a Document Follow APICVE-2026-660585.3 Medium
- elated-themes frappeFrappe: Field-level permission bypass via Document FollowCVE-2026-660595.3 Medium
- elated-themes frappeFrappe: Stored XSS in Column Headers via Data ImportCVE-2026-493915.1 Medium
- elated-themes frappeFrappe: Lack of Permissions in restore/bulk_restoreCVE-2026-477657.1 High
- elated-themes frappeFrappe: Host header poisoning can redirect magic login links to an attacker-controlled domainCVE-2026-471948.6 High
- elated-themes frappeFrappe Has Broken Access Control in its Workspace Save APICVE-2026-471855.1 Medium
- frappe erpnextERPNext v16.25.0 - Improper authorization in Prospect opportunities APICVE-2026-132277.1 High
- Show moreLoading…