Vulnerabilities in frappe
266 resultsCVE-2026-29081MEDIUMFrappe: Possibility of SQL Injection due to improper fieldname sanitizationEPSS 0.3%CVE-2026-94113HIGHFrappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet EndpointsEPSS 0.3%CVE-2026-44447HIGHERPNext: Possibility of SQL Injection due to missing validationEPSS 0.3%CVE-2023-54407MEDIUMFrappe 14.x before 14.45.0 Information Disclosure via Error Log TracebacksEPSS 0.3%CVE-2026-119144HIGHFrappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message FieldsEPSS 0.3%CVE-2026-109652HIGHFrappe ERPNext before 15.119.1 Server-Side Template Injection via Message FieldsEPSS 0.3%CVE-2026-39405CRITICALFrappe has Path Transversal via SCORMEPSS 0.3%CVE-2026-81731MEDIUMFrappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link DescriptionEPSS 0.3%CVE-2026-50708MEDIUMFrappe Framework 17.0.0-dev - Stored XSS in Multi Select Dialog result renderingEPSS 0.3%CVE-2026-50712MEDIUMFrappe Framework 17.0.0-dev - Stored XSS in Tree View node label renderingEPSS 0.3%CVE-2026-50709MEDIUMFrappe Framework 17.0.0-dev - Stored XSS in Notifications Events color renderingEPSS 0.3%CVE-2026-109634MEDIUMFrappe ERPNext before 15.121.0 SQL Injection via Unvalidated EndpointsEPSS 0.3%CVE-2025-55006MEDIUMFrappe Learning Holds Potential for Malicious SVG Upload in Image Upload FeatureEPSS 0.3%CVE-2025-52896HIGHFrappe authenticated XSS via data importEPSS 0.3%CVE-2025-62158LOWFrappe had attachments made by students to their assignments of type Text set to publicEPSS 0.3%CVE-2026-109601HIGHFrappe Framework before v16.30.0 Arbitrary File Read via Outgoing Email HTMLEPSS 0.3%CVE-2026-44442CRITICALERPNext: Unauthorised Document modification due to missing validationEPSS 0.3%CVE-2026-47182MEDIUMFrappe: Broken Access Control on Private FilesEPSS 0.3%CVE-2026-44975MEDIUMFrappe: Missing authorization on reset form toursEPSS 0.3%CVE-2026-111389HIGHFrappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing ValidationEPSS 0.3%