Vulnerabilidades em frappe

147 resultados
Análise Vexday

O ecossistema Frappe acumula 84 CVEs catalogadas, com um volume expressivo de 31 surgidas nos últimos 90 dias, o que indica ritmo elevado de descoberta recente e exige atenção contínua ao processo de atualização. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, sem registros confirmados de exploração em campo, e nenhuma CVE conta com PoC pública disponível — fatores que reduzem a pressão imediata, mas não eliminam o risco. O tipo de falha mais comum é CWE-79 (Cross-Site Scripting), padrão recorrente em frameworks de aplicações web que frequentemente indica lacunas no tratamento e sanitização de entradas. A CVE mais perigosa no momento, CVE-2023-46127, apresenta score EPSS de 0,37, sugerindo probabilidade não trivial de exploração futura e merecendo prioridade nos ciclos de correção, especialmente em ambientes expostos publicamente.

CVE-2026-44205MEDIUMFrappe: Stored Cross-Site Scripting (XSS) in User Profile through Image UploadEPSS 0.3%CVE-2026-53568MEDIUMFrappe: Stored XSS in Frappe Report/List View via 'set_link_title_field_value'EPSS 0.3%CVE-2026-47739MEDIUMFrappe: Stored XSS in NoteEPSS 0.3%CVE-2026-72907MEDIUMERPNext: Broken Access Control on certain endpointEPSS 0.2%CVE-2026-13227HIGHERPNext v16.25.0 - Improper authorization in Prospect opportunities APIEPSS 0.2%CVE-2025-59415MEDIUMFrappe Learning vulnerable to Malicious Content upload via Profile bio fieldEPSS 0.2%CVE-2026-42840MEDIUMERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literalsEPSS 0.2%CVE-2026-94113HIGHFrappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet EndpointsEPSS 0.2%CVE-2026-82634HIGHFrappe Framework Development Branch Incorrect Authorization via Jinja Template Preview EndpointEPSS 0.2%CVE-2026-66001HIGHFrappe: Improper Authorization in OAuth2 Consent EndpointEPSS 0.2%CVE-2026-40888MEDIUMFrappe HR vulnerable to Improper Access ControlEPSS 0.2%CVE-2026-40889MEDIUMFrappe HR has Improper Access Control on FilesEPSS 0.2%CVE-2026-41581MEDIUMFrappe Vulnerable to Possible SQL Injection via get_blog_listEPSS 0.2%CVE-2026-66058MEDIUMFrappe: Unrestricted access to a Document Follow APIEPSS 0.2%CVE-2026-44445MEDIUMERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI ModuleEPSS 0.2%CVE-2026-41320MEDIUMFrappe HR has possibility of SQL Injection due to improper field sanitizationEPSS 0.2%CVE-2026-12895HIGHSQL Injection in Frappe's ERPNextEPSS 0.2%CVE-2025-64705LOWFrappe user was able to access the submission of other studentsEPSS 0.2%CVE-2025-66581LOWFrappe LMS is Missing Server-Side Authorization in Business LogicEPSS 0.2%CVE-2026-72906MEDIUMERPNext: Unauthorised triggering of automated emails due to missing validationEPSS 0.2%