Vulnerabilidades de Frappe

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de Frappe: 232 registro(s), com severidade, exploração e correções.

Erpnext 109 Frappe 75 Lms 20 Learning 17 Frappe Framework 12 Hrms 10 Frappe Crm 4 Frappe Hr 4 Press 2 Helpdesk 1 Suite 1

Somente exploradas (KEV) →

CVE-2025-62779 Média · 5.4 CWE-79 27/10/2025

Frappe Learning users were able to add HTML through input fields in the Job Form

Frappe Learning is a learning system that helps users structure their content. In Frappe Learning 2.39.1 and earlier, users were able to add HTML through input fields in the Job Form.

CVE-2025-62778 Média · 5.3 CWE-425 27/10/2025

Frappe Learning allowed students to access the Quiz Form via direct URL

Frappe Learning is a learning management system. A security issue was identified in Frappe Learning 2.39.1 and earlier, where students were able to access the Quiz Form if they had the URL.

CVE-2025-62407 Média · 6.1 CWE-601 16/10/2025

Frappe has an Open Redirect on Login Page

Frappe is a full-stack web application framework. Prior to 14.98.0 and 15.83.0, an open redirect was possible through the redirect argument on the login page, if a specific type of URL was passed in. This vulnerability is fixed in 14.98.0 and 15.83.0.

CVE-2025-62158 Média · 5.3 CWE-200 10/10/2025

Frappe had attachments made by students to their assignments of type Text set to public

Frappe Learning is a learning system that helps users structure their content. In versions prior to 2.38.0, the system did stored the attachments uploaded by the students in their assignments as public files. This issue potentially exposed student-uploaded files to the public. Anyone with the file URL could access these files without authentication. The issue has been fixed in version 2.38.0 by ensuring all student-uploaded assignment attachments are stored as private files by default.

CVE-2025-11283 Baixa · 2.4 CWE-79 05/10/2025

Frappe LMS Course cross site scripting

A vulnerability was determined in Frappe LMS 2.35.0. This affects an unknown function of the component Course Handler. Executing manipulation of the argument Description can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. It is suggested to upgrade the affected component. The vendor was informed early about a total of four security issues and confirmed that those have been fixed. However, the release notes on GitHub do not mention them.

CVE-2025-11282 Média · 6.1 CWE-79 05/10/2025

Frappe LMS Incomplete Fix CVE-2025-55006 cross site scripting

A vulnerability was found in Frappe LMS 2.34.x/2.35.0. The impacted element is an unknown function of the component Incomplete Fix CVE-2025-55006. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The affected component should be upgraded. The vendor was informed early about a total of four security issues and confirmed that those have been fixed. However, the release notes on GitHub do not mention them.

CVE-2025-11280 Baixa · 3.7 CWE-425 05/10/2025

Frappe LMS Assignment Picture files direct request

A flaw has been found in Frappe LMS 2.35.0. Impacted is an unknown function of the file /files/ of the component Assignment Picture Handler. This manipulation causes direct request. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is considered difficult. The exploit has been published and may be used. It is advisable to upgrade the affected component. The vendor was informed early about a total of four security issues and confirmed that those have been fixed. However, the release notes on GitHub do not mention them.