Vulnerabilities in frappe
266 resultsCVE-2026-66001HIGHFrappe: Improper Authorization in OAuth2 Consent EndpointEPSS 0.3%CVE-2026-109674HIGHFrappe ERPNext before 16.6.0 SQL Injection via Missing Input ValidationEPSS 0.3%CVE-2026-109663HIGHFrappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint ParametersEPSS 0.3%CVE-2025-66205HIGHFrappe has the possibility of SQL Injection due to improper validationsEPSS 0.3%CVE-2026-32954HIGHERP has a possibility SQL Injection vulnerability due to missing validationEPSS 0.3%CVE-2026-26977MEDIUMFrappe Learning Management System exposes details of unpublished courses to unauthorized usersEPSS 0.3%CVE-2026-50711MEDIUMFrappe Framework 17.0.0-dev - Stored XSS in Number Card filter fields renderingEPSS 0.3%CVE-2026-50705MEDIUMFrappe Framework 17.0.0-dev - Stored XSS in Form Dashboard headline renderingEPSS 0.3%CVE-2026-50704MEDIUMFrappe Framework 17.0.0-dev - Reflected/Stored XSS in File View breadcrumbs renderingEPSS 0.3%CVE-2026-31877CRITICALFrappe SQL Injection due to improper field sanitizationEPSS 0.3%CVE-2026-50710MEDIUMFrappe Framework 17.0.0-dev - Stored XSS via eval in Number Card filters_configEPSS 0.3%CVE-2026-50698MEDIUMFrappe Framework 17.0.0-dev - Stored XSS in Audit Trail template renderingEPSS 0.3%CVE-2026-44207MEDIUMFrappe: Insecure Direct Object Reference for email accountsEPSS 0.3%CVE-2026-44208MEDIUMFrappe: IDOR in `submit_discussion()`EPSS 0.3%CVE-2026-109641MEDIUMFrappe ERPNext before 15.110.0 Missing Authorization in Record Creation EndpointsEPSS 0.3%CVE-2023-54406MEDIUMFrappe before 14.59.0 Safe Execution Flag Bypass in Server ScriptsEPSS 0.3%CVE-2026-115718MEDIUMFrappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_promptEPSS 0.3%CVE-2026-13227HIGHERPNext v16.25.0 - Improper authorization in Prospect opportunities APIEPSS 0.3%CVE-2026-44206MEDIUMFrappe: DB Schema Enumeration via Frappe-Authorization-SourceEPSS 0.3%CVE-2026-115717MEDIUMFrappe Builder before 1.36.1 SSRF via convert_to_webpEPSS 0.3%