Vulnerabilities in frappe

265 results
CVE-2026-109624HIGHFrappe ERPNext before 15.120.0 Missing Authorization Exposes Personal DataEPSS 0.3%CVE-2026-109656HIGHFrappe ERPNext before 15.118.2 Unauthorized Item Master Data AccessEPSS 0.3%CVE-2026-109658HIGHFrappe ERPNext before 15.115.0 Missing Authorization on EndpointsEPSS 0.3%CVE-2026-53568MEDIUMFrappe: Stored XSS in Frappe Report/List View via 'set_link_title_field_value'EPSS 0.3%CVE-2026-109659HIGHFrappe ERPNext before 15.113.0 Missing Authorization Exposes Financial DataEPSS 0.3%CVE-2026-63654MEDIUMFrappe: Unauthenticated Workflow approval via confirm_actionEPSS 0.3%CVE-2026-109608HIGHFrappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint InputEPSS 0.3%CVE-2026-109377MEDIUMERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup MethodsEPSS 0.3%CVE-2026-109376MEDIUMERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_htmlEPSS 0.3%CVE-2026-108734MEDIUMFrappe CRM 1.49.0 through 1.87.0 Missing Authorization via get_linked_docs_of_documentEPSS 0.3%CVE-2025-59415MEDIUMFrappe Learning vulnerable to Malicious Content upload via Profile bio fieldEPSS 0.3%CVE-2025-71431MEDIUMFrappe before 15.86.0 LDAP Injection via Unsanitized Endpoint ParametersEPSS 0.3%CVE-2026-109615HIGHFrappe ERPNext before 15.121.0 Missing Authorization in Document Creation EndpointsEPSS 0.2%CVE-2026-109645HIGHFrappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing AuthorizationEPSS 0.2%CVE-2026-109667HIGHFrappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record CreationEPSS 0.2%CVE-2026-109633HIGHFrappe ERPNext before 15.119.1 Stored XSS via Public Booking PageEPSS 0.2%CVE-2026-42840MEDIUMERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literalsEPSS 0.2%CVE-2026-61806MEDIUMFrappe LMS allows unpublished certificate accessEPSS 0.2%CVE-2026-108374HIGHERPNext: Unauthorised status modification due to missing validationEPSS 0.2%CVE-2026-109603MEDIUMFrappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkitEPSS 0.2%