Skip to contentFrappe vulnerabilities
Newest
- frappe erpnextFrappe ERPNext before 15.119.1 Server-Side Template Injection via Message FieldsCVE-2026-1096528.7 High
- frappe erpnextFrappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration FieldCVE-2026-1096515.3 Medium
- frappe erpnextFrappe ERPNext before 15.112.0 Missing Authorization Exposes Personal DataCVE-2026-1096507.1 High
- frappe erpnextFrappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint RequestsCVE-2026-1096497.1 High
- frappe erpnextFrappe ERPNext before 15.106.0 SQL Injection via Missing Input ValidationCVE-2026-1096487.1 High
- frappe erpnextFrappe ERPNext before 15.106.0 SQL Injection via Missing ValidationCVE-2026-1096477.1 High
- frappe erpnextFrappe ERPNext before 15.106.0 SQL Injection via Missing ValidationCVE-2026-1096467.1 High
- frappe erpnextFrappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing AuthorizationCVE-2026-1096457.1 High
- frappe erpnextFrappe ERPNext before 15.119.0 Unauthorized Access to Valuation DataCVE-2026-1096447.1 High
- frappe erpnextFrappe ERPNext before 15.111.0 Missing Authorization Exposes Project DataCVE-2026-1096437.1 High
- frappe erpnextFrappe ERPNext before 15.110.0 Missing Authorization in Certain EndpointsCVE-2026-1096425.3 Medium
- frappe erpnextFrappe ERPNext before 15.110.0 Missing Authorization in Record Creation EndpointsCVE-2026-1096416.9 Medium
- frappe erpnextFrappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record ModificationCVE-2026-1096407.2 High
- frappe erpnextFrappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint RequestsCVE-2026-1096397.1 High
- frappe erpnextFrappe ERPNext before 15.110.0 SQL Injection via Missing Input ValidationCVE-2026-1096387.1 High
- frappe erpnextFrappe ERPNext before 16.14.0 Missing Authorization Allows Master Data ModificationCVE-2026-1096377.1 High
- frappe erpnextFrappe ERPNext before 15.115.0 Missing Authorization Exposes Financial DataCVE-2026-1096367.1 High
- frappe erpnextFrappe ERPNext before 15.105.0 Missing Authorization in Document Creation EndpointsCVE-2026-1096355.3 Medium
- frappe erpnextFrappe ERPNext before 15.121.0 SQL Injection via Unvalidated EndpointsCVE-2026-1096346.9 Medium
- frappe erpnextFrappe ERPNext before 15.119.1 Stored XSS via Public Booking PageCVE-2026-1096338.6 High
- frappe erpnextFrappe ERPNext before 15.121.0 Missing Authorization on Certain EndpointsCVE-2026-1096327.1 High
- frappe erpnextFrappe ERPNext before 15.119.1 SQL Injection via Missing ValidationCVE-2026-1096317.1 High
- frappe erpnextFrappe ERPNext before 15.121.0 Missing Authorization in EndpointsCVE-2026-1096305.3 Medium
- frappe erpnextFrappe ERPNext before 15.121.3 Missing Authorization in Transactional Email EndpointCVE-2026-1096295.3 Medium
- frappe erpnextERPNext: Unauthorised status modification due to missing validationCVE-2026-1083747.7 High
- frappe erpnextFrappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing AuthorizationCVE-2026-1096287.1 High
- frappe erpnextFrappe ERPNext before 15.120.0 Missing Authorization Exposes Financial DataCVE-2026-1096277.1 High
- frappe erpnextFrappe ERPNext before 16.34.2 SQL Injection via Multiple EndpointsCVE-2026-1096267.1 High
- frappe erpnextFrappe ERPNext before 15.121.3 Missing Authorization Exposes Financial DataCVE-2026-1096257.1 High
- frappe erpnextFrappe ERPNext before 15.120.0 Missing Authorization Exposes Personal DataCVE-2026-1096247.1 High
- frappe erpnextFrappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing AuthorizationCVE-2026-1096235.3 Medium
- frappe erpnextFrappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing AuthorizationCVE-2026-1096225.3 Medium
- frappe erpnextFrappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission BypassCVE-2026-1096217.1 High
- frappe erpnextFrappe ERPNext before 15.121.0 Missing Authorization in Record Creation EndpointsCVE-2026-1096177.1 High
- frappe erpnextFrappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data ModificationCVE-2026-1096167.1 High
- frappe erpnextFrappe ERPNext before 15.121.0 Missing Authorization in Document Creation EndpointsCVE-2026-1096157.1 High
- frappe erpnextFrappe ERPNext before 16.34.0 Missing Authorization Exposes Financial DataCVE-2026-1096147.1 High
- frappe erpnextFrappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status ModificationCVE-2026-1096137.1 High
- frappe erpnextFrappe ERPNext before 15.120.0 Stored XSS via Report ViewCVE-2026-1096128.5 High
- frappe erpnextFrappe ERPNext before 15.121.0 Missing Authorization in Certain EndpointsCVE-2026-1096115.3 Medium
- frappe erpnextFrappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document ModificationCVE-2026-1096107.1 High
- frappe erpnextFrappe ERPNext before 15.119.1 SQL Injection via Missing Input ValidationCVE-2026-1096097.1 High
- frappe erpnextFrappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint InputCVE-2026-1096088.7 High
- frappe erpnextERPNext before 15.112.0 Stored XSS via Tool View Record NamesCVE-2026-1096048.5 High
- elated-themes frappeFrappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkitCVE-2026-1096034.8 Medium
- elated-themes frappeFrappe before v16.31.0 Stored XSS via Dashboard Chart FiltersCVE-2026-1096025.1 Medium
- elated-themes frappeFrappe Framework before v16.30.0 Arbitrary File Read via Outgoing Email HTMLCVE-2026-1096018.2 High
- elated-themes frappeFrappe before 16.31.0 Improper Access Control in Document Follow NotificationsCVE-2026-1096006.9 Medium
- elated-themes frappeFrappe before 15.113.3 Missing Authorization Allows Unauthorized Record ModificationCVE-2026-1095995.3 Medium
- elated-themes frappeFrappe before 16.33.0 Broken Authorization via send_sms EndpointCVE-2026-1095985.3 Medium
- Show moreLoading…