Filtered by vendor Frappe
Subscribe
Total
132 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-52048 | 1 Frappe | 1 Frappe | 2026-06-17 | N/A | 6.5 MEDIUM |
| In Frappe 15.x.x before 15.72.0 and 14.x.x before 14.96.10, in the function add_tag() at `frappe/desk/doctype/tag/tag.py` is vulnerable to SQL Injection, which allows an attacker to extract information from databases by injecting a SQL query into the `dt` parameter. | |||||
| CVE-2025-52047 | 1 Frappe | 1 Erpnext | 2026-06-17 | N/A | 6.5 MEDIUM |
| In Frappe ErpNext v15.57.5, the function get_income_account() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the filters.disabled parameter. | |||||
| CVE-2025-52044 | 1 Frappe | 1 Erpnext | 2026-06-17 | N/A | 7.5 HIGH |
| In Frappe ERPNext v15.57.5, the function get_stock_balance() at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into inventory_dimensions_dict parameter. | |||||
| CVE-2025-52043 | 1 Frappe | 1 Erpnext | 2026-06-17 | N/A | 6.5 MEDIUM |
| In Frappe ERPNext v15.57.5, the function import_coa() at erpnext/accounts/doctype/chart_of_accounts_importer/chart_of_accounts_importer.py is vulnerable to SQL injection, which allows an attacker to extract all information from databases by injecting a SQL query into the company parameter. | |||||
| CVE-2025-52042 | 1 Frappe | 1 Erpnext | 2026-06-17 | N/A | 8.2 HIGH |
| In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/request_for_quotation.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query via the txt parameter. | |||||
| CVE-2025-52041 | 1 Frappe | 1 Erpnext | 2026-06-17 | N/A | 8.2 HIGH |
| In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reconciliation.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the inventory_dimensions_dict parameter. | |||||
| CVE-2025-52040 | 1 Frappe | 1 Erpnext | 2026-06-17 | N/A | 8.2 HIGH |
| In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker can extract all information from databases by injecting a SQL query into the blanket_order_type parameter. | |||||
| CVE-2025-52039 | 1 Frappe | 1 Erpnext | 2026-06-17 | N/A | 8.2 HIGH |
| In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_request/material_request.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the txt parameter. | |||||
| CVE-2025-30217 | 1 Frappe | 1 Frappe | 2026-06-17 | N/A | 7.5 HIGH |
| Frappe is a full-stack web application framework. Prior to versions 14.93.2 and 15.55.0, a SQL Injection vulnerability has been identified in Frappe Framework which could allow a malicious actor to access sensitive information. Versions 14.93.2 and 15.55.0 contain a patch for the issue. No known workarounds are available. | |||||
| CVE-2025-30214 | 1 Frappe | 1 Frappe | 2026-06-17 | N/A | 7.5 HIGH |
| Frappe is a full-stack web application framework. Prior to versions 14.89.0 and 15.51.0, making crafted requests could lead to information disclosure that could further lead to account takeover. Versions 14.89.0 and 15.51.0 fix the issue. There's no workaround to fix this without upgrading. | |||||
| CVE-2025-30213 | 1 Frappe | 1 Frappe | 2026-06-17 | N/A | 8.8 HIGH |
| Frappe is a full-stack web application framework. Prior to versions 14.91.0 and 15.52.0, a system user was able to create certain documents in a specific way that could lead to remote code execution. Versions 14.9.1 and 15.52.0 contain a patch for the vulnerability. There's no workaround; an upgrade is required. | |||||
| CVE-2025-30212 | 1 Frappe | 1 Frappe | 2026-06-17 | N/A | 7.5 HIGH |
| Frappe is a full-stack web application framework. An SQL Injection vulnerability has been identified in Frappe Framework prior to versions 14.89.0 and 15.51.0 which could allow a malicious actor to access sensitive information. Versions 14.89.0 and 15.51.0 fix the issue. Upgrading is required; no other workaround is present. | |||||
| CVE-2025-28062 | 1 Frappe | 1 Erpnext | 2026-06-17 | N/A | 8.1 HIGH |
| A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to missing CSRF protections. | |||||
| CVE-2025-11281 | 1 Frappe | 1 Learning | 2026-06-17 | 4.6 MEDIUM | 5.0 MEDIUM |
| A vulnerability has been found in Frappe LMS 2.35.0. The affected element is an unknown function of the file /courses/ of the component Unpublished Course Handler. Such manipulation leads to improper access controls. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. You should upgrade the affected component. The vendor was informed early about a total of four security issues and confirmed that those have been fixed. However, the release notes on GitHub do not mention them. | |||||
| CVE-2024-34074 | 1 Frappe | 1 Frappe | 2026-06-17 | N/A | 6.1 MEDIUM |
| Frappe is a full-stack web application framework. Prior to 15.26.0 and 14.74.0, the login page accepts redirect argument and it allowed redirect to untrusted external URls. This behaviour can be used by malicious actors for phishing. This vulnerability is fixed in 15.26.0 and 14.74.0. | |||||
| CVE-2024-27105 | 1 Frappe | 1 Frappe | 2026-06-17 | N/A | 8.1 HIGH |
| Frappe is a full-stack web application framework. Prior to versions 14.66.3 and 15.16.0, file permission can be bypassed using certain endpoints, granting less privileged users permission to delete or clone a file. Versions 14.66.3 and 15.16.0 contain a patch for this issue. No known workarounds are available. | |||||
| CVE-2024-24813 | 1 Frappe | 1 Frappe | 2026-06-17 | N/A | 7.5 HIGH |
| Frappe is a full-stack web application framework. Prior to versions 14.64.0 and 15.0.0, SQL injection from a particular whitelisted method can result in access to data which the user doesn't have permission to access. Versions 14.64.0 and 15.0.0 contain a patch for this issue. No known workarounds are available. | |||||
| CVE-2024-24812 | 1 Frappe | 1 Frappe | 2026-06-17 | N/A | 5.4 MEDIUM |
| Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting (XSS) which can be used to inject malicious JS code if user clicks on a malicious link. This vulnerability has been patched in versions 14.59.0 and 15.5.0. No known workarounds are available. | |||||
| CVE-2023-5555 | 1 Frappe | 1 Learning | 2026-06-17 | N/A | 6.1 MEDIUM |
| Cross-site Scripting (XSS) - Generic in GitHub repository frappe/lms prior to 5614a6203fb7d438be8e2b1e3030e4528d170ec4. | |||||
| CVE-2023-46127 | 1 Frappe | 1 Frappe | 2026-06-17 | N/A | 5.4 MEDIUM |
| Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Frappe user with desk access could create documents containing HTML payloads allowing HTML Injection. This vulnerability has been patched in version 14.49.0. | |||||