CVE Intelligence

Frappe vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Frappe products: 235 record(s), with severity, exploitation and fixes.

Erpnext 109Frappe 75Lms 20Learning 17Frappe Framework 12Hrms 10Frappe Crm 6Frappe Hr 4Helpdesk 2Press 2Suite 1

Exploited only (KEV) →

CVE-2026-50701 Medium · 5.1 CWE-79 Jun 24, 2026
Frappe Framework 17.0.0-dev - Reflected DOM XSS in dashboard-view breadcrumb rendering
A Reflected Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the dashboard-view component.
CVE-2026-50700 Medium · 4.6 CWE-79 Jun 24, 2026
Frappe Framework 17.0.0-dev - Stored XSS in frappe.get_avatar image rendering
A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the frappe.get_avatar function.
CVE-2026-50699 Medium · 4.6 CWE-79 Jun 24, 2026
Frappe Framework 17.0.0-dev - Stored XSS in Auto Repeat dashboard schedule rendering
A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev. An authenticated attacker with write access to Auto Repeat can persist HTML/JavaScript in reference_document using a whitelisted write path and trigger script execution when users open the affected Auto Repeat form.
CVE-2026-50698 Medium · 4.6 CWE-79 Jun 24, 2026
Frappe Framework 17.0.0-dev - Stored XSS in Audit Trail template rendering
A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input before generating HTML output in the Audit Trail component.
CVE-2026-53568 Medium · 6.9 CWE-79 Jun 12, 2026
Frappe: Stored XSS in Frappe Report/List View via 'set_link_title_field_value'
Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, there is a stored XSS vulnerablity in Frappe Report/List View. This issue has been patched in versions 15.107.2 and 16.17.4.
CVE-2026-50026 Medium · 6.9 CWE-862 Jun 12, 2026
Frappe: Lack of permissions checks in 'relink' and 'set_email_password' endpoints
Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, a lack of permission checks in these endpoints allowed unauthorized access to resources. This issue has been patched in versions 15.107.0 and 16.17.0.
CVE-2026-47182 Medium · 5.3 CWE-284 Jun 12, 2026
Frappe: Broken Access Control on Private Files
Frappe is a full-stack web application framework. Prior to version 16.17.4, any authenticated user can access private files by guessing the file path. This issue has been patched in version 16.17.4.
CVE-2026-44976 Medium · 5.3 CWE-284 Jun 12, 2026
Frappe: IDOR in update_onboarding_step
Frappe is a full-stack web application framework. Prior to version 16.17.4, any user can modify any field in any Onboarding Step record. This issue has been patched in version 16.17.4.
CVE-2026-44975 Medium · 5.3 CWE-862 Jun 12, 2026
Frappe: Missing authorization on reset form tours
Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, any authenticated user can reset onboarding for all users in the system. This issue has been patched in versions 15.107.2 and 16.17.4.
CVE-2026-44208 Medium · 6.9 CWE-284 Jun 12, 2026
Frappe: IDOR in `submit_discussion()`
Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, lack of validations in the "submit_discussion()" endpoint allows for unauthorized access to resources. This issue has been patched in versions 15.107.0 and 16.17.0.
CVE-2026-44207 Medium · 6.9 CWE-639 Jun 12, 2026
Frappe: Insecure Direct Object Reference for email accounts
Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, an IDOR vulnerability allows authenticated users to access other users' email configuration details. This issue has been patched in versions 15.107.0 and 16.17.0.
CVE-2026-44206 Medium · 6.9 CWE-200 Jun 12, 2026
Frappe: DB Schema Enumeration via Frappe-Authorization-Source
Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, DB Schema Enumeration is possible through exploiting an endpoint. This issue has been patched in versions 15.107.2 and 16.17.4.
CVE-2026-47739 Medium · 6.9 CWE-79 Jun 12, 2026
Frappe: Stored XSS in Note
Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, stored XSS in Note was possible due to lack of sanitization. This issue has been patched in versions 15.106.0 and 16.16.0.
CVE-2026-44205 Medium · 6.9 CWE-79 Jun 12, 2026
Frappe: Stored Cross-Site Scripting (XSS) in User Profile through Image Upload
Frappe is a full-stack web application framework. Prior to version 15.106.0, a stored XSS vulnerability in the user profile image section allows an attacker to execute malicious scripts in the browsers of other users. This issue has been patched in version 15.106.0.
CVE-2026-41581 Medium · 6.9 CWE-89 Jun 12, 2026
Frappe Vulnerable to Possible SQL Injection via get_blog_list
Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, there is a possible SQL Injection via get_blog_list. This issue has been patched in versions 15.106.0 and 16.16.0.
CVE-2026-46546 Medium · 5.4 CWE-79 Jun 9, 2026
Frappe LMS: HTML injection in user-controlled metadata
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.53.0, an authenticated user could supply specially crafted content in certain user-editable fields that, when surfaced in page metadata, caused visitors' browsers to navigate to an attacker-chosen URL. This issue has been patched in version 2.53.0.
CVE-2026-42840 Medium · 5.1 CWE-79 Jun 3, 2026
ERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literals
An authenticated user can persist arbitrary HTML/JavaScript in the email_id or mobile_no fields of a Customer record and trigger unescaped rendering in the Point of Sale (POS) interface for every operator who selects that customer. This issue affects ERPNext: 16.16.0.
CVE-2026-42839 Medium · 4.8 CWE-79 Jun 3, 2026
ERPNext 16.16.0 - Stored XSS in POS cart item rendering
An authenticated ERPNext user with Item record edit permissions can persist arbitrary HTML/JavaScript in the item_name, description, or image fields of an Item and trigger unescaped rendering in the Point of Sale (POS) cart interface for every operator who adds that item to a transaction.This issue affects ERPNext: 16.16.0.
CVE-2026-45081 Medium · 6.5 CWE-863 May 27, 2026
Frappe HR: Permission Bypass in HRMS Leave Details API
Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.5.0, authenticated employees could access other employees’ leave details due to improper authorization checks. This vulnerability is fixed in 16.5.0.
CVE-2026-39405 Critical · 9.4 CWE-22 May 20, 2026
Frappe has Path Transversal via SCORM
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.50.0 and below, a user with course editing role could upload a SCORM ZIP package to write files outside the intended directory. This issue has been resolved in version 2.50.1.
CVE-2026-39352 High · 8.7 Public exploit CWE-22 May 20, 2026
Frappe has an Arbitrary File Read via Path Traversal in render_include
Frappe is a full-stack web application framework. Versions prior to 15.105.0 and 16.15.0 contain a possible Arbitrary File Read vulnerability via Path Traversal. The issue is resolved in versions 16.15.0, 15.105.0 and above.
CVE-2026-44448 Medium · 6.5 CWE-862 May 13, 2026
ERPNext: Unauthorised Document modification due to missing validation
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.102.0 and 16.11.0, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 15.102.0 and 16.11.0.
CVE-2026-44447 High · 7.5 CWE-89 May 13, 2026
ERPNext: Possibility of SQL Injection due to missing validation
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.0, some endpoints were vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This vulnerability is fixed in 16.9.0.
CVE-2026-44446 High · 7.5 CWE-89 May 13, 2026
ERPNext: Possibility of SQL Injection due to missing validation
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.14.0, some endpoints were vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This vulnerability is fixed in 15.104.3 and 16.14.0.
CVE-2026-44445 Medium · 6.5 CWE-611 May 13, 2026
ERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI Module
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.12.0, an improper restriction of XML external entity (XXE) reference vulnerability in the EDI Module enables an authenticated attacker to read files from the local file system, including sensitive configuration files. This vulnerability is fixed in 15.104.3 and 16.12.0.