[ Vendor · 103 CVEs ]
frappe
CVEs affecting frappe published in the last 30 days, plus any frappe CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114664 | 22 Oct 2026 | CVSS 7.1 | frappeFrappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to… | |
| CVE-2026-111937 | 19 Oct 2026 | CVSS 5.4 | frappe crmFrappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification… | |
| CVE-2026-111938 | 19 Oct 2026 | CVSS 4.3 | frappe crmFrappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by… | |
| CVE-2026-111939 | 19 Oct 2026 | CVSS 4.6 | frappe helpdeskFrappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating… | |
| CVE-2026-64862 | 16 Oct 2026 | CVSS 6.5 | frappe hrmsFrappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not… | |
| CVE-2026-55796 | 16 Oct 2026 | CVSS 6.5 | frappe hrmsFrappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs… | |
| CVE-2026-108373 | 16 Oct 2026 | CVSS 6.5 | frappe erpnextERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise… | |
| CVE-2026-108374 | 16 Oct 2026 | CVSS 7.7 | frappe erpnextERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to… | |
| CVE-2026-111388 | 16 Oct 2026 | CVSS 5.4 | frappeFrappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods… | |
| CVE-2026-111389 | 16 Oct 2026 | CVSS 7.7 | frappe hrmsFrappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by… | |
| CVE-2026-66057 | 13 Oct 2026 | CVSS 5.1 | frappeFrappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state… | |
| CVE-2026-55823 | 13 Oct 2026 | CVSS 8.7 | frappeFrappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated… | |
| CVE-2026-109672 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109673 | 12 Oct 2026 | CVSS 7.3 | frappe erpnextFrappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are… | |
| CVE-2026-109674 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation… | |
| CVE-2026-109675 | 12 Oct 2026 | CVSS 4.3 | frappe suiteFrappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the get_mailboxes and get_quota… | |
| CVE-2026-109666 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109667 | 12 Oct 2026 | CVSS 8.8 | frappe erpnextFrappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the… | |
| CVE-2026-109668 | 12 Oct 2026 | CVSS 4.3 | frappe erpnextFrappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records… | |
| CVE-2026-109669 | 12 Oct 2026 | CVSS 4.3 | frappe erpnextFrappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce… | |
| CVE-2026-109670 | 12 Oct 2026 | CVSS 5.4 | frappe erpnextFrappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered… | |
| CVE-2026-109671 | 12 Oct 2026 | CVSS 7.3 | frappe erpnextFrappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered… | |
| CVE-2026-109660 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that… | |
| CVE-2026-109661 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109662 | 12 Oct 2026 | CVSS 6.1 | frappe erpnextFrappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts… | |
| CVE-2026-109663 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints… | |
| CVE-2026-109664 | 12 Oct 2026 | CVSS 4.3 | frappe erpnextFrappe ERPNext before 15.112.0 contains a missing authorization vulnerability that allows authenticated users with a common operational role to… | |
| CVE-2026-109665 | 12 Oct 2026 | CVSS 4.3 | frappe erpnextFrappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109654 | 12 Oct 2026 | CVSS 5.4 | frappe erpnextFrappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that… | |
| CVE-2026-109655 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109656 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce… | |
| CVE-2026-109657 | 12 Oct 2026 | CVSS 5.4 | frappe erpnextFrappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script through a… | |
| CVE-2026-109658 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce… | |
| CVE-2026-109659 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce… | |
| CVE-2026-109648 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation… | |
| CVE-2026-109649 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation… | |
| CVE-2026-109650 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109651 | 12 Oct 2026 | CVSS 4.3 | frappe erpnextFrappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability caused by a configuration field, writable… | |
| CVE-2026-109652 | 12 Oct 2026 | CVSS 8.8 | frappe erpnextFrappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields… | |
| CVE-2026-109653 | 12 Oct 2026 | CVSS 7.3 | frappe erpnextFrappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into… | |
| CVE-2026-109643 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail… | |
| CVE-2026-109644 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109645 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109646 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation… | |
| CVE-2026-109647 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input… | |
| CVE-2026-109637 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their… | |
| CVE-2026-109638 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation… | |
| CVE-2026-109639 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation… | |
| CVE-2026-109640 | 12 Oct 2026 | CVSS 8.1 | frappe erpnextFrappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints… | |
| CVE-2026-109641 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109642 | 12 Oct 2026 | CVSS 4.3 | frappe erpnextFrappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce… | |
| CVE-2026-109632 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce… | |
| CVE-2026-109633 | 12 Oct 2026 | CVSS 8.1 | frappe erpnextFrappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a… | |
| CVE-2026-109634 | 12 Oct 2026 | CVSS 4.9 | frappe erpnextFrappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in some endpoints due to missing input validation… | |
| CVE-2026-109635 | 12 Oct 2026 | CVSS 4.3 | frappe erpnextFrappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing authorization vulnerability in certain document creation endpoints that… | |
| CVE-2026-109636 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce… | |
| CVE-2026-109626 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated… | |
| CVE-2026-109627 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce… | |
| CVE-2026-109628 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109629 | 12 Oct 2026 | CVSS 4.3 | frappe erpnextFrappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactional email… | |
| CVE-2026-109630 | 12 Oct 2026 | CVSS 4.3 | frappe erpnextFrappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce… | |
| CVE-2026-109631 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing… | |
| CVE-2026-109617 | 12 Oct 2026 | CVSS 7.1 | frappe erpnextFrappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109621 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling… | |
| CVE-2026-109622 | 12 Oct 2026 | CVSS 4.3 | frappe erpnextFrappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce… | |
| CVE-2026-109623 | 12 Oct 2026 | CVSS 5.4 | frappe erpnextFrappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109624 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109625 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109612 | 12 Oct 2026 | CVSS 7.3 | frappe erpnextFrappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored… | |
| CVE-2026-109613 | 12 Oct 2026 | CVSS 7.1 | frappe erpnextFrappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce… | |
| CVE-2026-109614 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their… | |
| CVE-2026-109615 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109616 | 12 Oct 2026 | CVSS 7.1 | frappe erpnextFrappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce… | |
| CVE-2026-109603 | 12 Oct 2026 | CVSS 3.3 | frappeFrappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-26240) for PDF generation, enabling… | |
| CVE-2026-109604 | 12 Oct 2026 | CVSS 7.3 | frappe erpnextFrappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored… | |
| CVE-2026-109608 | 12 Oct 2026 | CVSS 8.8 | frappe erpnextFrappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any… | |
| CVE-2026-109609 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation… | |
| CVE-2026-109610 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce… | |
| CVE-2026-109611 | 12 Oct 2026 | CVSS 4.3 | frappe erpnextFrappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109598 | 12 Oct 2026 | CVSS 4.3 | frappeFrappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted send_sms API endpoint… | |
| CVE-2026-109599 | 12 Oct 2026 | CVSS 4.3 | frappeFrappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper… | |
| CVE-2026-109600 | 12 Oct 2026 | CVSS 5.3 | frappeFrappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email… | |
| CVE-2026-109601 | 12 Oct 2026 | CVSS 6.5 | frappeFrappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing… | |
| CVE-2026-109602 | 12 Oct 2026 | CVSS 5.4 | frappeFrappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart filters because jQuery renders… | |
| CVE-2025-71431 | 12 Oct 2026 | CVSS 5.3 | frappeFrappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied… | |
| CVE-2025-71432 | 12 Oct 2026 | CVSS 8.1 | frappe erpnextFrappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a… | |
| CVE-2024-58390 | 12 Oct 2026 | CVSS 8.8 | frappeFrappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that… | |
| CVE-2024-58391 | 12 Oct 2026 | CVSS 4.3 | frappeFrappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not escaped… | |
| CVE-2025-71430 | 12 Oct 2026 | CVSS 5.4 | frappeFrappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are… | |
| CVE-2023-54407 | 12 Oct 2026 | CVSS 4.9 | frappeFrappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to view secrets stored in local… | |
| CVE-2023-54408 | 12 Oct 2026 | CVSS 6.1 | frappeFrappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in… | |
| CVE-2023-54409 | 12 Oct 2026 | CVSS 4.8 | frappeFrappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user… | |
| CVE-2023-54410 | 12 Oct 2026 | CVSS 4.3 | frappeFrappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a missing… | |
| CVE-2023-54411 | 12 Oct 2026 | CVSS 5.9 | frappeFrappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other… | |
| CVE-2023-54412 | 12 Oct 2026 | CVSS 6.5 | frappeFrappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any… | |
| CVE-2023-54406 | 12 Oct 2026 | CVSS 4.9 | frappeFrappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.in_safe_exec global flag can become False during Server… | |
| CVE-2026-109376 | 12 Oct 2026 | CVSS 4.3 | Frappe ERPNextERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html method that lets authenticated portal… | |
| CVE-2026-109377 | 12 Oct 2026 | CVSS 4.3 | Frappe ERPNextERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view stock quantities via whitelisted… | |
| CVE-2026-108732 | 11 Oct 2026 | CVSS 4.3 | frappe hrmsFrappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the… | |
| CVE-2026-108733 | 11 Oct 2026 | CVSS 4.3 | frappe hrmsFrappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the… |
Page 1 of 2