Vulnerabilidades em frappe

261 resultados
Análise Vexday

O ecossistema Frappe acumula 84 CVEs catalogadas, com um volume expressivo de 31 surgidas nos últimos 90 dias, o que indica ritmo elevado de descoberta recente e exige atenção contínua ao processo de atualização. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, sem registros confirmados de exploração em campo, e nenhuma CVE conta com PoC pública disponível — fatores que reduzem a pressão imediata, mas não eliminam o risco. O tipo de falha mais comum é CWE-79 (Cross-Site Scripting), padrão recorrente em frameworks de aplicações web que frequentemente indica lacunas no tratamento e sanitização de entradas. A CVE mais perigosa no momento, CVE-2023-46127, apresenta score EPSS de 0,37, sugerindo probabilidade não trivial de exploração futura e merecendo prioridade nos ciclos de correção, especialmente em ambientes expostos publicamente.

CVE-2024-58391MEDIUMFrappe before 15.4.0 XSS via Printview ParametersEPSS 0.3%CVE-2026-39351MEDIUMFrappe allows unrestricted Doctype access via API exploitEPSS 0.3%CVE-2026-47194HIGHFrappe: Host header poisoning can redirect magic login links to an attacker-controlled domainEPSS 0.3%CVE-2026-42839MEDIUMERPNext 16.16.0 - Stored XSS in POS cart item renderingEPSS 0.3%CVE-2026-55796MEDIUMFrappe HR: SQL Injection in HRMS Salary Payments via ECS ReportEPSS 0.3%CVE-2026-50026MEDIUMFrappe: Lack of permissions checks in 'relink' and 'set_email_password' endpointsEPSS 0.3%CVE-2026-108733MEDIUMFrappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocationEPSS 0.3%CVE-2026-111938MEDIUMFrappe CRM before 1.74.0 Missing Authorization via add_note_to_call_logEPSS 0.3%CVE-2026-47739MEDIUMFrappe: Stored XSS in NoteEPSS 0.3%CVE-2026-109672HIGHFrappe ERPNext before 15.118.0 Missing Authorization Exposes Financial DataEPSS 0.3%CVE-2026-109658HIGHFrappe ERPNext before 15.115.0 Missing Authorization on EndpointsEPSS 0.3%CVE-2026-109659HIGHFrappe ERPNext before 15.113.0 Missing Authorization Exposes Financial DataEPSS 0.3%CVE-2026-109627HIGHFrappe ERPNext before 15.120.0 Missing Authorization Exposes Financial DataEPSS 0.3%CVE-2026-109644HIGHFrappe ERPNext before 15.119.0 Unauthorized Access to Valuation DataEPSS 0.3%CVE-2026-109624HIGHFrappe ERPNext before 15.120.0 Missing Authorization Exposes Personal DataEPSS 0.3%CVE-2026-109614HIGHFrappe ERPNext before 16.34.0 Missing Authorization Exposes Financial DataEPSS 0.3%CVE-2026-53568MEDIUMFrappe: Stored XSS in Frappe Report/List View via 'set_link_title_field_value'EPSS 0.3%CVE-2026-109643HIGHFrappe ERPNext before 15.111.0 Missing Authorization Exposes Project DataEPSS 0.3%CVE-2026-109632HIGHFrappe ERPNext before 15.121.0 Missing Authorization on Certain EndpointsEPSS 0.3%CVE-2026-109661HIGHFrappe ERPNext before 15.116.0 Missing Authorization Exposes Financial DataEPSS 0.3%