Vulnerabilidades em frappe

261 resultados
Análise Vexday

O ecossistema Frappe acumula 84 CVEs catalogadas, com um volume expressivo de 31 surgidas nos últimos 90 dias, o que indica ritmo elevado de descoberta recente e exige atenção contínua ao processo de atualização. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, sem registros confirmados de exploração em campo, e nenhuma CVE conta com PoC pública disponível — fatores que reduzem a pressão imediata, mas não eliminam o risco. O tipo de falha mais comum é CWE-79 (Cross-Site Scripting), padrão recorrente em frameworks de aplicações web que frequentemente indica lacunas no tratamento e sanitização de entradas. A CVE mais perigosa no momento, CVE-2023-46127, apresenta score EPSS de 0,37, sugerindo probabilidade não trivial de exploração futura e merecendo prioridade nos ciclos de correção, especialmente em ambientes expostos publicamente.

CVE-2026-109660HIGHFrappe ERPNext before 15.112.0 Missing Authorization in Production Record EndpointsEPSS 0.2%CVE-2026-109637HIGHFrappe ERPNext before 16.14.0 Missing Authorization Allows Master Data ModificationEPSS 0.2%CVE-2026-109610HIGHFrappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document ModificationEPSS 0.2%CVE-2026-109628HIGHFrappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing AuthorizationEPSS 0.2%CVE-2026-41320MEDIUMFrappe HR has possibility of SQL Injection due to improper field sanitizationEPSS 0.2%CVE-2026-29077HIGHFrappe: Broken Access Control in DocShareEPSS 0.2%CVE-2026-61805MEDIUMFrappe LMS: Quiz result manipulation and cross-user submission forgeryEPSS 0.2%CVE-2025-62778LOWFrappe Learning allowed students to access the Quiz Form via direct URLEPSS 0.2%CVE-2026-109669MEDIUMFrappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status ModificationEPSS 0.2%CVE-2026-109673HIGHFrappe ERPNext before 16.12.0 Stored XSS via Crafted Record NamesEPSS 0.2%CVE-2026-34606MEDIUMStored XSS in Frappe LMSEPSS 0.2%CVE-2026-109671HIGHFrappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal PagesEPSS 0.2%CVE-2026-109653HIGHFrappe ERPNext before 15.119.0 Stored XSS Leading to Account TakeoverEPSS 0.2%CVE-2026-109612HIGHFrappe ERPNext before 15.120.0 Stored XSS via Report ViewEPSS 0.2%CVE-2026-109604HIGHERPNext before 15.112.0 Stored XSS via Tool View Record NamesEPSS 0.2%CVE-2025-68928MEDIUMFrappe CRM vulnerable to authenticated XSS via website fieldEPSS 0.2%CVE-2026-26031LOWFrappe LMS affected by unauthorised user was able to access the full list of batch enrolled studentsEPSS 0.2%CVE-2026-109662MEDIUMFrappe ERPNext before 15.112.0 Stored XSS via Public Portal FormEPSS 0.2%CVE-2026-109651MEDIUMFrappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration FieldEPSS 0.2%CVE-2026-109630MEDIUMFrappe ERPNext before 15.121.0 Missing Authorization in EndpointsEPSS 0.2%