agentprime: frappe

agentprime: frappeEvery new CVE for frappe.https://agentprime.io/CVE-2026-119145: Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Uploadhttps://agentprime.io/advisories/CVE-2026-119145/https://agentprime.io/advisories/CVE-2026-119145/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 15:58:23 GMTCVEcriticalCVE-2026-119144: Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fieldshttps://agentprime.io/advisories/CVE-2026-119144/https://agentprime.io/advisories/CVE-2026-119144/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 15:58:22 GMTCVECVE-2026-114664: Frappe before 16.33.0 Blind SQL Injection via get_eventshttps://agentprime.io/advisories/CVE-2026-114664/https://agentprime.io/advisories/CVE-2026-114664/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 22 Oct 2026 01:43:47 GMTCVECVE-2026-111388: Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authenticationhttps://agentprime.io/advisories/CVE-2026-111388/https://agentprime.io/advisories/CVE-2026-111388/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 Oct 2026 01:17:56 GMTCVECVE-2026-55823: Frappe: Possibility of SQL injection in reportviewhttps://agentprime.io/advisories/CVE-2026-55823/https://agentprime.io/advisories/CVE-2026-55823/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Oct 2026 16:49:28 GMTCVECVE-2026-66057: Frappe: Open Redirect via Unsanitized OAuth State Param.https://agentprime.io/advisories/CVE-2026-66057/https://agentprime.io/advisories/CVE-2026-66057/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Oct 2026 16:48:03 GMTCVECVE-2026-109603: Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkithttps://agentprime.io/advisories/CVE-2026-109603/https://agentprime.io/advisories/CVE-2026-109603/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 22:21:55 GMTCVECVE-2026-109602: Frappe before v16.31.0 Stored XSS via Dashboard Chart Filtershttps://agentprime.io/advisories/CVE-2026-109602/https://agentprime.io/advisories/CVE-2026-109602/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 22:21:55 GMTCVECVE-2026-109601: Frappe Framework before v16.30.0 Arbitrary File Read via Outgoing Email HTMLhttps://agentprime.io/advisories/CVE-2026-109601/https://agentprime.io/advisories/CVE-2026-109601/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 22:21:54 GMTCVECVE-2026-109600: Frappe before 16.31.0 Improper Access Control in Document Follow Notificationshttps://agentprime.io/advisories/CVE-2026-109600/https://agentprime.io/advisories/CVE-2026-109600/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 22:21:53 GMTCVECVE-2026-109599: Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modificationhttps://agentprime.io/advisories/CVE-2026-109599/https://agentprime.io/advisories/CVE-2026-109599/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 22:21:53 GMTCVECVE-2026-109598: Frappe before 16.33.0 Broken Authorization via send_sms Endpointhttps://agentprime.io/advisories/CVE-2026-109598/https://agentprime.io/advisories/CVE-2026-109598/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 22:21:52 GMTCVECVE-2025-71431: Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoint Parametershttps://agentprime.io/advisories/CVE-2025-71431/https://agentprime.io/advisories/CVE-2025-71431/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 22:21:47 GMTCVECVE-2025-71430: Frappe before 15.91.1 Stored XSS via Leaderboard User Nameshttps://agentprime.io/advisories/CVE-2025-71430/https://agentprime.io/advisories/CVE-2025-71430/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 22:21:46 GMTCVECVE-2024-58391: Frappe before 15.4.0 XSS via Printview Parametershttps://agentprime.io/advisories/CVE-2024-58391/https://agentprime.io/advisories/CVE-2024-58391/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 22:21:45 GMTCVECVE-2024-58390: Frappe before 15.41.0 Privilege Escalation via Document Actionhttps://agentprime.io/advisories/CVE-2024-58390/https://agentprime.io/advisories/CVE-2024-58390/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 22:21:44 GMTCVECVE-2023-54412: Frappe before 13.46.3 Improper Access Control for Email Templateshttps://agentprime.io/advisories/CVE-2023-54412/https://agentprime.io/advisories/CVE-2023-54412/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 22:21:43 GMTCVECVE-2023-54411: Frappe before 13.32.0 Weak Authentication via Print View Keyhttps://agentprime.io/advisories/CVE-2023-54411/https://agentprime.io/advisories/CVE-2023-54411/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 22:21:42 GMTCVECVE-2023-54410: Frappe before 13.22.0 Improper Authorization via Document Renamehttps://agentprime.io/advisories/CVE-2023-54410/https://agentprime.io/advisories/CVE-2023-54410/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 22:21:42 GMTCVECVE-2023-54409: Frappe before 13.46.1 XSS via html2text Weak Sanitizationhttps://agentprime.io/advisories/CVE-2023-54409/https://agentprime.io/advisories/CVE-2023-54409/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 22:21:41 GMTCVECVE-2023-54408: Frappe before 14.31.0 HTML Injection via Weak Escapinghttps://agentprime.io/advisories/CVE-2023-54408/https://agentprime.io/advisories/CVE-2023-54408/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 22:21:40 GMTCVECVE-2023-54407: Frappe 14.x before 14.45.0 Information Disclosure via Error Log Tracebackshttps://agentprime.io/advisories/CVE-2023-54407/https://agentprime.io/advisories/CVE-2023-54407/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 22:21:40 GMTCVECVE-2023-54406: Frappe before 14.59.0 Safe Execution Flag Bypass in Server Scriptshttps://agentprime.io/advisories/CVE-2023-54406/https://agentprime.io/advisories/CVE-2023-54406/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 22:21:38 GMTCVECVE-2023-51769: Cross-site scripting in Frappehttps://agentprime.io/advisories/CVE-2023-51769/https://agentprime.io/advisories/CVE-2023-51769/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 00:00:00 GMTCVECVE-2026-82634: Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpointhttps://agentprime.io/advisories/CVE-2026-82634/https://agentprime.io/advisories/CVE-2026-82634/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Sun, 30 Aug 2026 12:34:52 GMTCVECVE-2026-81731: Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Descriptionhttps://agentprime.io/advisories/CVE-2026-81731/https://agentprime.io/advisories/CVE-2026-81731/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 27 Aug 2026 20:07:35 GMTCVECVE-2026-66003: Frappe: Access control bypass via REST API dot-notation fields on linked doctypeshttps://agentprime.io/advisories/CVE-2026-66003/https://agentprime.io/advisories/CVE-2026-66003/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 26 Aug 2026 19:30:28 GMTCVECVE-2026-66002: Frappe: User Enumeration via PDDRhttps://agentprime.io/advisories/CVE-2026-66002/https://agentprime.io/advisories/CVE-2026-66002/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Aug 2026 18:29:40 GMTCVECVE-2026-66001: Frappe: Improper Authorization in OAuth2 Consent Endpointhttps://agentprime.io/advisories/CVE-2026-66001/https://agentprime.io/advisories/CVE-2026-66001/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Aug 2026 18:27:32 GMTCVECVE-2026-62315: Frappe: Mass assignment via set_valuehttps://agentprime.io/advisories/CVE-2026-62315/https://agentprime.io/advisories/CVE-2026-62315/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Aug 2026 18:25:01 GMTCVECVE-2026-63654: Frappe: Unauthenticated Workflow approval via confirm_actionhttps://agentprime.io/advisories/CVE-2026-63654/https://agentprime.io/advisories/CVE-2026-63654/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Aug 2026 18:23:52 GMTCVECVE-2026-53569: Frappe: Missing authorization in toggle_like and mark_as_seenhttps://agentprime.io/advisories/CVE-2026-53569/https://agentprime.io/advisories/CVE-2026-53569/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Aug 2026 18:15:20 GMTCVECVE-2026-66000: Frappe: Unrestricted access to Document Follow APIshttps://agentprime.io/advisories/CVE-2026-66000/https://agentprime.io/advisories/CVE-2026-66000/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 07 Aug 2026 18:25:11 GMTCVECVE-2025-58375: Frappe has potential SQL Injection due to missing validationhttps://agentprime.io/advisories/CVE-2025-58375/https://agentprime.io/advisories/CVE-2025-58375/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 07 Aug 2026 18:21:10 GMTCVECVE-2026-66058: Frappe: Unrestricted access to a Document Follow APIhttps://agentprime.io/advisories/CVE-2026-66058/https://agentprime.io/advisories/CVE-2026-66058/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 07 Aug 2026 17:54:09 GMTCVECVE-2026-66059: Frappe: Field-level permission bypass via Document Followhttps://agentprime.io/advisories/CVE-2026-66059/https://agentprime.io/advisories/CVE-2026-66059/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 07 Aug 2026 15:21:51 GMTCVECVE-2026-49391: Frappe: Stored XSS in Column Headers via Data Importhttps://agentprime.io/advisories/CVE-2026-49391/https://agentprime.io/advisories/CVE-2026-49391/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 21:36:24 GMTCVECVE-2026-47765: Frappe: Lack of Permissions in restore/bulk_restorehttps://agentprime.io/advisories/CVE-2026-47765/https://agentprime.io/advisories/CVE-2026-47765/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 21:25:31 GMTCVECVE-2026-47194: Frappe: Host header poisoning can redirect magic login links to an attacker-controlled domainhttps://agentprime.io/advisories/CVE-2026-47194/https://agentprime.io/advisories/CVE-2026-47194/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 21:19:19 GMTCVECVE-2026-47185: Frappe Has Broken Access Control in its Workspace Save APIhttps://agentprime.io/advisories/CVE-2026-47185/https://agentprime.io/advisories/CVE-2026-47185/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 21:08:14 GMTCVECVE-2026-55852: Frappe: TarSlip RCE in Package Importhttps://agentprime.io/advisories/CVE-2026-55852/https://agentprime.io/advisories/CVE-2026-55852/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Jul 2026 21:28:29 GMTCVECVE-2026-42219: Frappe: Path Traversal via /backups Routehttps://agentprime.io/advisories/CVE-2026-42219/https://agentprime.io/advisories/CVE-2026-42219/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Jul 2026 21:26:30 GMTCVECVE-2026-49394: Frappe: Auth. bypass via update_pagehttps://agentprime.io/advisories/CVE-2026-49394/https://agentprime.io/advisories/CVE-2026-49394/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Jul 2026 21:24:47 GMTCVECVE-2026-48127: Frappe: Arbitrary Attachment Injection via add_attachments and upload_filehttps://agentprime.io/advisories/CVE-2026-48127/https://agentprime.io/advisories/CVE-2026-48127/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Jul 2026 21:23:37 GMTCVECVE-2026-41482: Frappe: Possible Path Traversal and Local File Inclusion via Chrome PDF Generatorhttps://agentprime.io/advisories/CVE-2026-41482/https://agentprime.io/advisories/CVE-2026-41482/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Jul 2026 21:20:36 GMTCVECVE-2026-47199: Frappe: check_safe_sql_query Permits SELECT INTO OUTFILEhttps://agentprime.io/advisories/CVE-2026-47199/https://agentprime.io/advisories/CVE-2026-47199/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Jul 2026 21:14:12 GMTCVECVE-2026-58503: Frappe: Unauthenticated User Enumeration via reset_passwordhttps://agentprime.io/advisories/CVE-2026-58503/https://agentprime.io/advisories/CVE-2026-58503/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Jul 2026 21:12:28 GMTCVECVE-2026-47422: Frappe: Unrestricted API access to save_reporthttps://agentprime.io/advisories/CVE-2026-47422/https://agentprime.io/advisories/CVE-2026-47422/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Jul 2026 21:09:58 GMTCVECVE-2026-53568: Frappe: Stored XSS in Frappe Report/List View via 'set_link_title_field_value'https://agentprime.io/advisories/CVE-2026-53568/https://agentprime.io/advisories/CVE-2026-53568/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 12 Jun 2026 14:45:11 GMTCVECVE-2026-50026: Frappe: Lack of permissions checks in 'relink' and 'set_email_password' endpointshttps://agentprime.io/advisories/CVE-2026-50026/https://agentprime.io/advisories/CVE-2026-50026/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 12 Jun 2026 14:43:41 GMTCVE