Vulnerabilidades em frappe

261 resultados
Análise Vexday

O ecossistema Frappe acumula 84 CVEs catalogadas, com um volume expressivo de 31 surgidas nos últimos 90 dias, o que indica ritmo elevado de descoberta recente e exige atenção contínua ao processo de atualização. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, sem registros confirmados de exploração em campo, e nenhuma CVE conta com PoC pública disponível — fatores que reduzem a pressão imediata, mas não eliminam o risco. O tipo de falha mais comum é CWE-79 (Cross-Site Scripting), padrão recorrente em frameworks de aplicações web que frequentemente indica lacunas no tratamento e sanitização de entradas. A CVE mais perigosa no momento, CVE-2023-46127, apresenta score EPSS de 0,37, sugerindo probabilidade não trivial de exploração futura e merecendo prioridade nos ciclos de correção, especialmente em ambientes expostos publicamente.

CVE-2026-109616HIGHFrappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data ModificationEPSS 0.2%CVE-2026-64862MEDIUMFrappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMSEPSS 0.2%CVE-2026-108373MEDIUMERPNext: Unauthorised access to financial data due to missing validationEPSS 0.2%CVE-2026-109600MEDIUMFrappe before 16.31.0 Improper Access Control in Document Follow NotificationsEPSS 0.2%CVE-2026-111937MEDIUMFrappe CRM before 1.81.2 Missing Authorization on CRM Notification RecordsEPSS 0.2%CVE-2026-116492HIGHFrappe CRM before 1.89.1 Missing Authorization via Phone Lookup APIEPSS 0.2%CVE-2026-40888MEDIUMFrappe HR vulnerable to Improper Access ControlEPSS 0.2%CVE-2026-40889MEDIUMFrappe HR has Improper Access Control on FilesEPSS 0.2%CVE-2025-64705LOWFrappe user was able to access the submission of other studentsEPSS 0.2%CVE-2026-41581MEDIUMFrappe Vulnerable to Possible SQL Injection via get_blog_listEPSS 0.2%CVE-2026-61803MEDIUMFrappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amountEPSS 0.2%CVE-2026-44445MEDIUMERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI ModuleEPSS 0.2%CVE-2023-54409MEDIUMFrappe before 13.46.1 XSS via html2text Weak SanitizationEPSS 0.2%CVE-2026-111939MEDIUMFrappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket CreationEPSS 0.2%CVE-2026-109640HIGHFrappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record ModificationEPSS 0.2%CVE-2026-109617HIGHFrappe ERPNext before 15.121.0 Missing Authorization in Record Creation EndpointsEPSS 0.2%CVE-2025-66581LOWFrappe LMS is Missing Server-Side Authorization in Business LogicEPSS 0.2%CVE-2026-109666HIGHFrappe ERPNext before 15.110.0 Missing Authorization in Inventory Record EndpointsEPSS 0.2%CVE-2026-109655HIGHFrappe ERPNext before 15.115.0 Missing Authorization in Inventory EndpointsEPSS 0.2%CVE-2023-54412HIGHFrappe before 13.46.3 Improper Access Control for Email TemplatesEPSS 0.2%