Vulnerabilidades em frappe

265 resultados
Análise Vexday

O ecossistema Frappe acumula 84 CVEs catalogadas, com um volume expressivo de 31 surgidas nos últimos 90 dias, o que indica ritmo elevado de descoberta recente e exige atenção contínua ao processo de atualização. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, sem registros confirmados de exploração em campo, e nenhuma CVE conta com PoC pública disponível — fatores que reduzem a pressão imediata, mas não eliminam o risco. O tipo de falha mais comum é CWE-79 (Cross-Site Scripting), padrão recorrente em frameworks de aplicações web que frequentemente indica lacunas no tratamento e sanitização de entradas. A CVE mais perigosa no momento, CVE-2023-46127, apresenta score EPSS de 0,37, sugerindo probabilidade não trivial de exploração futura e merecendo prioridade nos ciclos de correção, especialmente em ambientes expostos publicamente.

CVE-2026-109629MEDIUMFrappe ERPNext before 15.121.3 Missing Authorization in Transactional Email EndpointEPSS 0.2%CVE-2025-62779LOWFrappe Learning users were able to add HTML through input fields in the Job FormEPSS 0.2%CVE-2026-121442MEDIUMFrappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances APIEPSS 0.2%CVE-2025-64707LOWFrappe LMS revoking access did not show immediate effect as roles were cachedEPSS 0.2%CVE-2026-111388MEDIUMFrappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth AuthenticationEPSS 0.2%CVE-2026-109623MEDIUMFrappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing AuthorizationEPSS 0.2%CVE-2026-109654MEDIUMFrappe ERPNext before 15.119.0 Missing Authorization in Transactional Email EndpointsEPSS 0.2%CVE-2025-67730MEDIUMFrappe authenticated users can execute XSS through form description fieldsEPSS 0.2%CVE-2026-23497LOWFrappe LMS has a Stored XSS via Unsanitized Image Filename in Course and Jobs PagesEPSS 0.2%CVE-2026-109670MEDIUMFrappe ERPNext before 15.110.0 Stored XSS via Item Record NameEPSS 0.2%CVE-2025-71430MEDIUMFrappe before 15.91.1 Stored XSS via Leaderboard User NamesEPSS 0.2%CVE-2026-109675MEDIUMFrappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIsEPSS 0.2%CVE-2026-109657MEDIUMFrappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record NameEPSS 0.2%CVE-2026-109602MEDIUMFrappe before v16.31.0 Stored XSS via Dashboard Chart FiltersEPSS 0.2%CVE-2025-67734MEDIUMFrappe Authenticated Users can Execute JavaScript through its Job FormEPSS 0.2%CVE-2026-41317MEDIUMFrappe Press has an unsafe HTTP method / CSRF-adjacent issue on API secret generationEPSS 0.2%CVE-2026-31879MEDIUMFrappe Workspace modification and stored XSS due to improper resource ownership checksEPSS 0.2%CVE-2026-44441MEDIUMERPNext: Possible SSRF by any authenticated userEPSS 0.2%CVE-2026-41430LOWPress vulnerable to reflected XSS on login redirectionEPSS 0.2%CVE-2026-44448MEDIUMERPNext: Unauthorised Document modification due to missing validationEPSS 0.1%