Advisories · Technology
Frappe.
Every CVE that names Frappe among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.6 Medium
Frappe Framework 16.10.0 - Stored DOM XSS in Multiple Field Formatters
- Frappe
- Cross-site scripting (XSS)
- CVSS 4.6 Medium
Frappe Framework 16.10.0 - Stored DOM XSS in Tag Pill Renderer
- Frappe
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Frappe allows unrestricted Doctype access via API exploit
- frappe
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
Frappe has a SQL injection in bulk_update
- frappe
- SQL injection
- CVSS 5.1 Medium
Frappe Workspace modification and stored XSS due to improper resource ownership checks
- frappe
- Cross-site scripting (XSS)
- CVSS 5.0 Medium
Frappe: Possible SSRF by any authenticated user
- frappe
- Server-side request forgery (SSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
Frappe SQL Injection due to improper field sanitization
- frappe
- SQL injection
- CVSS 6.5 Medium
Frappe: Possibility of SQL Injection due to improper fieldname sanitization
- frappe
- SQL injection
- CVSS 7.1 High
Frappe: Broken Access Control in DocShare
- frappe
- Broken access control
- CWE-602
- CVSS 1.3 Low
Frappe: Stored XSS in avatar_macro.html
- frappe
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Frappe Affected by XSS and Open Redirect in Sign Up
- frappe
- Cross-site scripting (XSS)
- Open redirect
- CVSS 7.5 High
Certain Frappe requests are vulnerable to Path Traversal
- frappe
- Path traversal
- CVSS 9.1 CriticalCritical · CVSS 9+
Frappe may be vulnerable remote code execution due to server-side template injection
- frappe
- Code injection
- CVSS 6.8 Medium
Frappe vulnerable to a path traversal allowing reading certain files
- frappe
- Path traversal
- CVSS 7.1 High
Frappe has the possibility of SQL Injection due to improper validations
- frappe
- SQL injection
- CVSS 6.1 Medium
Frappe has an Open Redirect on Login Page
- frappe
- Open redirect
- CVSS 8.7 High
Frappe has the possibility of SQL Injection due to improper validations
- frappe
- SQL injection
- CVSS 6.3 Medium
Frappe has the possibility of Authenticated SQL Injection due to improper validations
- frappe
- SQL injection
- CVSS 8.7 High
Frappe account takeover via password reset token leakage
- frappe
- Information disclosure
- CVSS 8.6 High
Frappe authenticated XSS via data import
- frappe
- Cross-site scripting (XSS)
- CVSS 8.7 High
Frappe possibility of SQL injection due to improper validations
- frappe
- SQL injection
- CVSS 6.1 Medium
Frappe vuilnerable to an open redirect on login page
- frappe
- Open redirect
- CVSS 8.1 High
Frappe File Permissions can by bypassed using certain endpoints
- frappe
- Broken access control
- CVSS 7.5 High
Frappe SQL Injection from reporting logic
- frappe
- SQL injection
- CVSS 5.4 Medium
Frappe Authenticated Reflected Cross site scripting (XSS) in portal pages
- frappe
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Frappe vulnerable to HTML injection by any Desk user
- frappe
- Cross-site scripting (XSS)
- CVSS 4.2 Medium
Possibility limited SQL injection due to insufficient validation in Frappe
- frappe
- SQL injection
- CVSS 6.5 Medium
Path traversal in Frappe
- Frappe
- Path traversal
- CVSS 3.5 Low
Frappe Search navbar_search.html cross site scripting
- Frappe
- CWE-707
-
ERPNext - Improper user access conrol
- frappe
- Broken access control
-
ERPNext - Stored XSS in My Settings
- frappe
- Cross-site scripting (XSS)
-
ERPNext - Stored XSS in My Profile
- frappe
- Cross-site scripting (XSS)