frappe.

Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload

• frappe
• Path traversal

Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields

• frappe
• Code injection

Frappe before 16.33.0 Blind SQL Injection via get_events

• frappe
• SQL injection

Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication

• frappe
• Broken access control

Frappe: Possibility of SQL injection in reportview

• frappe
• SQL injection

Frappe: Open Redirect via Unsanitized OAuth State Param.

• frappe
• Open redirect

Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkit

• frappe
• Server-side request forgery (SSRF)

Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters

• frappe
• Cross-site scripting (XSS)

Frappe Framework before v16.30.0 Arbitrary File Read via Outgoing Email HTML

• frappe
• Path traversal

Frappe before 16.31.0 Improper Access Control in Document Follow Notifications

• frappe
• Broken access control

Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification

• frappe
• Broken access control

Frappe before 16.33.0 Broken Authorization via send_sms Endpoint

• frappe
• Broken access control

Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoint Parameters

• frappe
• Other injection

Frappe before 15.91.1 Stored XSS via Leaderboard User Names

• frappe
• Cross-site scripting (XSS)

Frappe before 15.4.0 XSS via Printview Parameters

• frappe
• Cross-site scripting (XSS)

Frappe before 15.41.0 Privilege Escalation via Document Action

• frappe
• Privilege escalation

Frappe before 13.46.3 Improper Access Control for Email Templates

• frappe
• Broken access control

Frappe before 13.32.0 Weak Authentication via Print View Key

• frappe
• Authentication bypass

Frappe before 13.22.0 Improper Authorization via Document Rename

• frappe
• Broken access control

Frappe before 13.46.1 XSS via html2text Weak Sanitization

• frappe
• Cross-site scripting (XSS)

Frappe before 14.31.0 HTML Injection via Weak Escaping

• frappe
• Cross-site scripting (XSS)

Frappe 14.x before 14.45.0 Information Disclosure via Error Log Tracebacks

• frappe
• Information disclosure

Frappe before 14.59.0 Safe Execution Flag Bypass in Server Scripts

• frappe
• CWE-372

Cross-site scripting in Frappe

• Frappe
• Cross-site scripting (XSS)

Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint

• frappe
• Broken access control

Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description

• frappe
• Cross-site scripting (XSS)

Frappe: Access control bypass via REST API dot-notation fields on linked doctypes

• frappe
• Broken access control

Frappe: User Enumeration via PDDR

• frappe
• CWE-204

Frappe: Improper Authorization in OAuth2 Consent Endpoint

• frappe
• Cross-site request forgery (CSRF)

Frappe: Mass assignment via set_value

• frappe
• Broken access control

Frappe: Unauthenticated Workflow approval via confirm_action

• frappe
• Cross-site request forgery (CSRF)

Frappe: Missing authorization in toggle_like and mark_as_seen

• frappe
• Broken access control

Frappe: Unrestricted access to Document Follow APIs

• frappe
• Broken access control

Frappe has potential SQL Injection due to missing validation

• frappe
• SQL injection

Frappe: Unrestricted access to a Document Follow API

• frappe
• Broken access control

Frappe: Field-level permission bypass via Document Follow

• frappe
• Broken access control

Frappe: Stored XSS in Column Headers via Data Import

• frappe
• Cross-site scripting (XSS)

Frappe: Lack of Permissions in restore/bulk_restore

• frappe
• Broken access control

Frappe: Host header poisoning can redirect magic login links to an attacker-controlled domain

• frappe
• CWE-346

Frappe Has Broken Access Control in its Workspace Save API

• frappe
• Cross-site scripting (XSS)
• Broken access control

Frappe: TarSlip RCE in Package Import

• frappe
• Path traversal

Frappe: Path Traversal via /backups Route

• frappe
• Path traversal

Frappe: Auth. bypass via update_page

• frappe
• Broken access control

Frappe: Arbitrary Attachment Injection via add_attachments and upload_file

• frappe
• Broken access control

Frappe: Possible Path Traversal and Local File Inclusion via Chrome PDF Generator

• frappe
• Path traversal

Frappe: check_safe_sql_query Permits SELECT INTO OUTFILE

• frappe
• SQL injection

Frappe: Unauthenticated User Enumeration via reset_password

• frappe
• Information disclosure

Frappe: Unrestricted API access to save_report

• frappe
• Broken access control

Frappe: Stored XSS in Frappe Report/List View via 'set_link_title_field_value'

• frappe
• Cross-site scripting (XSS)

Frappe: Lack of permissions checks in 'relink' and 'set_email_password' endpoints

• frappe
• Broken access control

Frappe: Broken Access Control on Private Files

• frappe
• Broken access control

Frappe: IDOR in update_onboarding_step

• frappe
• Broken access control

Frappe: Missing authorization on reset form tours

• frappe
• Broken access control

Frappe: DB Schema Enumeration via Frappe-Authorization-Source

• frappe
• Information disclosure

Frappe: Insecure Direct Object Reference for email accounts

• frappe
• Broken access control

Frappe: IDOR in `submit_discussion()`

• frappe
• Broken access control

Frappe: Stored Cross-Site Scripting (XSS) in User Profile through Image Upload

• frappe
• Cross-site scripting (XSS)

Frappe Vulnerable to Possible SQL Injection via get_blog_list

• frappe
• SQL injection

Frappe: Stored XSS in Note

• frappe
• Cross-site scripting (XSS)

Frappe has an Arbitrary File Read via Path Traversal in render_include

• frappe
• Path traversal