Vulnerabilidades em frappe

261 resultados
Análise Vexday

O ecossistema Frappe acumula 84 CVEs catalogadas, com um volume expressivo de 31 surgidas nos últimos 90 dias, o que indica ritmo elevado de descoberta recente e exige atenção contínua ao processo de atualização. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, sem registros confirmados de exploração em campo, e nenhuma CVE conta com PoC pública disponível — fatores que reduzem a pressão imediata, mas não eliminam o risco. O tipo de falha mais comum é CWE-79 (Cross-Site Scripting), padrão recorrente em frameworks de aplicações web que frequentemente indica lacunas no tratamento e sanitização de entradas. A CVE mais perigosa no momento, CVE-2023-46127, apresenta score EPSS de 0,37, sugerindo probabilidade não trivial de exploração futura e merecendo prioridade nos ciclos de correção, especialmente em ambientes expostos publicamente.

CVE-2026-109661HIGHFrappe ERPNext before 15.116.0 Missing Authorization Exposes Financial DataEPSS 0.3%CVE-2026-109643HIGHFrappe ERPNext before 15.111.0 Missing Authorization Exposes Project DataEPSS 0.3%CVE-2026-53568MEDIUMFrappe: Stored XSS in Frappe Report/List View via 'set_link_title_field_value'EPSS 0.3%CVE-2026-109632HIGHFrappe ERPNext before 15.121.0 Missing Authorization on Certain EndpointsEPSS 0.3%CVE-2026-109627HIGHFrappe ERPNext before 15.120.0 Missing Authorization Exposes Financial DataEPSS 0.3%CVE-2026-63654MEDIUMFrappe: Unauthenticated Workflow approval via confirm_actionEPSS 0.3%CVE-2026-109608HIGHFrappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint InputEPSS 0.3%CVE-2026-108734MEDIUMFrappe CRM 1.49.0 through 1.87.0 Missing Authorization via get_linked_docs_of_documentEPSS 0.3%CVE-2026-109377MEDIUMERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup MethodsEPSS 0.3%CVE-2026-109376MEDIUMERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_htmlEPSS 0.3%CVE-2025-71431MEDIUMFrappe before 15.86.0 LDAP Injection via Unsanitized Endpoint ParametersEPSS 0.3%CVE-2025-59415MEDIUMFrappe Learning vulnerable to Malicious Content upload via Profile bio fieldEPSS 0.3%CVE-2026-109615HIGHFrappe ERPNext before 15.121.0 Missing Authorization in Document Creation EndpointsEPSS 0.2%CVE-2026-109645HIGHFrappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing AuthorizationEPSS 0.2%CVE-2026-109667HIGHFrappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record CreationEPSS 0.2%CVE-2026-109633HIGHFrappe ERPNext before 15.119.1 Stored XSS via Public Booking PageEPSS 0.2%CVE-2026-61806MEDIUMFrappe LMS allows unpublished certificate accessEPSS 0.2%CVE-2026-42840MEDIUMERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literalsEPSS 0.2%CVE-2026-108374HIGHERPNext: Unauthorised status modification due to missing validationEPSS 0.2%CVE-2026-109603MEDIUMFrappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkitEPSS 0.2%