CVE-2026-50699: falha de média gravidade em Frappe Framework
Frappe Framework 17.0.0-dev - Stored XSS in Auto Repeat dashboard schedule rendering
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.6epss 0.4%
A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev. An authenticated attacker with write access to Auto Repeat can persist HTML/JavaScript in reference_document using a whitelisted write path and trigger script execution when users open the affected Auto Repeat form.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
Frappe · Frappe FrameworkCVEs relacionadas — Frappe Framework
No mesmo produto, das mais perigosas para as menos.
CVE-2026-50701MEDIUMFrappe Framework 17.0.0-dev - Reflected DOM XSS in dashboard-view breadcrumb renderingEPSS 0.5%CVE-2026-50700MEDIUMFrappe Framework 17.0.0-dev - Stored XSS in frappe.get_avatar image renderingEPSS 0.4%CVE-2026-50703MEDIUMFrappe Framework 17.0.0-dev - Stored XSS in Desktop Icon label renderingEPSS 0.4%CVE-2026-50711MEDIUMFrappe Framework 17.0.0-dev - Stored XSS in Number Card filter fields renderingEPSS 0.3%CVE-2026-50710MEDIUMFrappe Framework 17.0.0-dev - Stored XSS via eval in Number Card filters_configEPSS 0.3%CVE-2026-50705MEDIUMFrappe Framework 17.0.0-dev - Stored XSS in Form Dashboard headline renderingEPSS 0.3%