Vulnerabilidades em frappe

261 resultados
Análise Vexday

O ecossistema Frappe acumula 84 CVEs catalogadas, com um volume expressivo de 31 surgidas nos últimos 90 dias, o que indica ritmo elevado de descoberta recente e exige atenção contínua ao processo de atualização. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, sem registros confirmados de exploração em campo, e nenhuma CVE conta com PoC pública disponível — fatores que reduzem a pressão imediata, mas não eliminam o risco. O tipo de falha mais comum é CWE-79 (Cross-Site Scripting), padrão recorrente em frameworks de aplicações web que frequentemente indica lacunas no tratamento e sanitização de entradas. A CVE mais perigosa no momento, CVE-2023-46127, apresenta score EPSS de 0,37, sugerindo probabilidade não trivial de exploração futura e merecendo prioridade nos ciclos de correção, especialmente em ambientes expostos publicamente.

CVE-2026-44975MEDIUMFrappe: Missing authorization on reset form toursEPSS 0.3%CVE-2026-109609HIGHFrappe ERPNext before 15.119.1 SQL Injection via Missing Input ValidationEPSS 0.3%CVE-2026-109639HIGHFrappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint RequestsEPSS 0.3%CVE-2026-109646HIGHFrappe ERPNext before 15.106.0 SQL Injection via Missing ValidationEPSS 0.3%CVE-2026-109626HIGHFrappe ERPNext before 16.34.2 SQL Injection via Multiple EndpointsEPSS 0.3%CVE-2026-109648HIGHFrappe ERPNext before 15.106.0 SQL Injection via Missing Input ValidationEPSS 0.3%CVE-2026-109649HIGHFrappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint RequestsEPSS 0.3%CVE-2026-109638HIGHFrappe ERPNext before 15.110.0 SQL Injection via Missing Input ValidationEPSS 0.3%CVE-2026-109647HIGHFrappe ERPNext before 15.106.0 SQL Injection via Missing ValidationEPSS 0.3%CVE-2026-109631HIGHFrappe ERPNext before 15.119.1 SQL Injection via Missing ValidationEPSS 0.3%CVE-2026-109621HIGHFrappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission BypassEPSS 0.3%CVE-2026-109613HIGHFrappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status ModificationEPSS 0.3%CVE-2026-35614CRITICALFrappe has a SQL injection in bulk_updateEPSS 0.3%CVE-2025-71432HIGHFrappe ERPNext before 15.83.0 Reflected XSS Leading to Account TakeoverEPSS 0.3%CVE-2024-58390HIGHFrappe before 15.41.0 Privilege Escalation via Document ActionEPSS 0.3%CVE-2026-44446HIGHERPNext: Possibility of SQL Injection due to missing validationEPSS 0.3%CVE-2023-54411HIGHFrappe before 13.32.0 Weak Authentication via Print View KeyEPSS 0.3%CVE-2024-58391MEDIUMFrappe before 15.4.0 XSS via Printview ParametersEPSS 0.3%CVE-2025-62407MEDIUMFrappe has an Open Redirect on Login PageEPSS 0.3%CVE-2023-51769MEDIUMFrappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages.EPSS 0.3%