Vulnerabilidades em frappe

147 resultados
Análise Vexday

O ecossistema Frappe acumula 84 CVEs catalogadas, com um volume expressivo de 31 surgidas nos últimos 90 dias, o que indica ritmo elevado de descoberta recente e exige atenção contínua ao processo de atualização. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, sem registros confirmados de exploração em campo, e nenhuma CVE conta com PoC pública disponível — fatores que reduzem a pressão imediata, mas não eliminam o risco. O tipo de falha mais comum é CWE-79 (Cross-Site Scripting), padrão recorrente em frameworks de aplicações web que frequentemente indica lacunas no tratamento e sanitização de entradas. A CVE mais perigosa no momento, CVE-2023-46127, apresenta score EPSS de 0,37, sugerindo probabilidade não trivial de exploração futura e merecendo prioridade nos ciclos de correção, especialmente em ambientes expostos publicamente.

CVE-2025-68929CRITICALFrappe may be vulnerable remote code execution due to server-side template injectionEPSS 0.5%CVE-2023-41328MEDIUMPossibility limited SQL injection due to insufficient validation in FrappeEPSS 0.5%CVE-2025-11280MEDIUMFrappe LMS Assignment Picture files direct requestEPSS 0.5%CVE-2026-54343HIGHFrappe LMS: Path Traversal in SCORM File ServingEPSS 0.5%CVE-2026-66002MEDIUMFrappe: User Enumeration via PDDREPSS 0.5%CVE-2026-50701MEDIUMFrappe Framework 17.0.0-dev - Reflected DOM XSS in dashboard-view breadcrumb renderingEPSS 0.5%CVE-2023-5555HIGHCross-site Scripting (XSS) - Generic in frappe/lmsEPSS 0.4%CVE-2025-59421LOWPress vulnerable to email flooding to users due to lack of validation and rate limitsEPSS 0.4%CVE-2026-50705MEDIUMFrappe Framework 17.0.0-dev - Stored XSS in Form Dashboard headline renderingEPSS 0.4%CVE-2026-50704MEDIUMFrappe Framework 17.0.0-dev - Reflected/Stored XSS in File View breadcrumbs renderingEPSS 0.4%CVE-2026-50710MEDIUMFrappe Framework 17.0.0-dev - Stored XSS via eval in Number Card filters_configEPSS 0.4%CVE-2026-50700MEDIUMFrappe Framework 17.0.0-dev - Stored XSS in frappe.get_avatar image renderingEPSS 0.4%CVE-2026-50698MEDIUMFrappe Framework 17.0.0-dev - Stored XSS in Audit Trail template renderingEPSS 0.4%CVE-2026-50711MEDIUMFrappe Framework 17.0.0-dev - Stored XSS in Number Card filter fields renderingEPSS 0.4%CVE-2026-47765HIGHFrappe: Lack of Permissions in restore/bulk_restoreEPSS 0.4%CVE-2025-52898HIGHFrappe account takeover via password reset token leakageEPSS 0.4%CVE-2025-30212MEDIUMFrappe has possibility of SQL injection due to improper validationsEPSS 0.4%CVE-2025-68953HIGHCertain Frappe requests are vulnerable to Path TraversalEPSS 0.4%CVE-2025-11283MEDIUMFrappe LMS Course cross site scriptingEPSS 0.4%CVE-2026-50709MEDIUMFrappe Framework 17.0.0-dev - Stored XSS in Notifications Events color renderingEPSS 0.4%