Frappe
Page 2 of 2 — Frappe CVEs from a corpus of 103, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-66434 | High | 8.8 | 2025-12-15 | An SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through 15.89.0. The function renders att… |
CVE-2025-67734 | Medium | 5.4 | 2025-12-12 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allowed authenticated attackers… |
CVE-2025-67730 | Medium | 5.4 | 2025-12-12 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allow authenticated users to ad… |
CVE-2025-10655 | High | 8.8 | 2025-12-09 | SQL Injection in Frappe HelpDesk in the dashboard get_dashboard_data due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.This… |
CVE-2025-66581 | Medium | 6.5 | 2025-12-05 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.41.0, a flaw in the server-side authorization… |
CVE-2025-65267 | Critical | 9.0 | 2025-12-03 | In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payloa… |
CVE-2025-66206 | Medium | 6.8 | 2025-12-01 | Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, certain requests were vulnerable to path traversal attacks, wherein some files… |
CVE-2025-66205 | High | 7.1 | 2025-12-01 | Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to error-based SQL injection due to lack of v… |
CVE-2025-11461 | High | 8.8 | 2025-11-26 | Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements. This issue af… |
CVE-2025-64707 | Medium | 5.4 | 2025-11-12 | Frappe Learning is a learning system that helps users structure their content. Starting in version 2.0.0 and prior to version 2.41.0, when admins revoked a rol… |
CVE-2025-64705 | Medium | 4.3 | 2025-11-12 | Frappe Learning is a learning system that helps users structure their content. Starting in version 2.0.0 and prior to version 2.41.0, users were able to access… |
CVE-2025-62779 | Medium | 5.4 | 2025-10-27 | Frappe Learning is a learning system that helps users structure their content. In Frappe Learning 2.39.1 and earlier, users were able to add HTML through input… |
CVE-2025-62778 | Medium | 5.3 | 2025-10-27 | Frappe Learning is a learning management system. A security issue was identified in Frappe Learning 2.39.1 and earlier, where students were able to access the… |
CVE-2025-62407 | Medium | 6.1 | 2025-10-16 | Frappe is a full-stack web application framework. Prior to 14.98.0 and 15.83.0, an open redirect was possible through the redirect argument on the login page… |
CVE-2025-62158 | Medium | 5.3 | 2025-10-10 | Frappe Learning is a learning system that helps users structure their content. In versions prior to 2.38.0, the system did stored the attachments uploaded by t… |
CVE-2025-11283 | Low | 2.4 | 2025-10-05 | A vulnerability was determined in Frappe LMS 2.35.0. This affects an unknown function of the component Course Handler. Executing manipulation of the argument D… |
CVE-2025-11282 | Low | 2.4 | 2025-10-05 | A vulnerability was found in Frappe LMS 2.34.x/2.35.0. The impacted element is an unknown function of the component Incomplete Fix CVE-2025-55006. Performing a… |
CVE-2025-11281 | Medium | 5.0 | 2025-10-05 | A vulnerability has been found in Frappe LMS 2.35.0. The affected element is an unknown function of the file /courses/ of the component Unpublished Course Hand… |
CVE-2025-11280 | Low | 3.7 | 2025-10-05 | A flaw has been found in Frappe LMS 2.35.0. Impacted is an unknown function of the file /files/ of the component Assignment Picture Handler. This manipulation… |
CVE-2025-56381 | Medium | 6.5 | 2025-10-02 | ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the order_by and g… |
CVE-2025-56380 | Medium | 6.5 | 2025-10-02 | Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value API endpoint and a… |
CVE-2025-56379 | Medium | 5.4 | 2025-10-02 | A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2025-52042 | High | 8.2 | 2025-10-01 | In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/request_for_quotation.py is vulnerable to… |
CVE-2025-52041 | High | 8.2 | 2025-10-01 | In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reconciliation.py is vulnerable to SQL Inje… |
CVE-2025-52040 | High | 8.2 | 2025-10-01 | In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker can ext… |
CVE-2025-52039 | High | 8.2 | 2025-10-01 | In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_request/material_request.py is vulnerable t… |
CVE-2025-52050 | Medium | 6.5 | 2025-09-30 | In Frappe ERPNext 15.57.5, the function get_loyalty_program_details_with_points() at erpnext/accounts/doctype/loyalty_program/loyalty_program.py is vulnerable… |
CVE-2025-52049 | Medium | 6.5 | 2025-09-30 | In Frappe ErpNext v15.57.5, the function get_timesheet_detail_rate() at erpnext/projects/doctype/timesheet/timesheet.py is vulnerable to SQL Injection, which a… |
CVE-2025-52047 | Medium | 6.5 | 2025-09-30 | In Frappe ErpNext v15.57.5, the function get_income_account() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker to ext… |
CVE-2025-52043 | Medium | 6.5 | 2025-09-30 | In Frappe ERPNext v15.57.5, the function import_coa() at erpnext/accounts/doctype/chart_of_accounts_importer/chart_of_accounts_importer.py is vulnerable to SQL… |
CVE-2025-59421 | | 2025-09-18 | Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). A bad actor can flood t… | |
CVE-2025-59415 | Medium | 4.6 | 2025-09-17 | Frappe Learning is a learning system that helps users structure their content. In versions 2.34.1 and below, there is a security vulnerability in Frappe Learni… |
CVE-2025-52044 | High | 7.5 | 2025-09-16 | In Frappe ERPNext v15.57.5, the function get_stock_balance() at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attacker to extract all… |
CVE-2025-52048 | Medium | 6.5 | 2025-09-15 | In Frappe 15.x.x before 15.72.0 and 14.x.x before 14.96.10, in the function add_tag() at `frappe/desk/doctype/tag/tag.py` is vulnerable to SQL Injection, which… |
CVE-2025-58439 | High | 8.1 | 2025-09-06 | ERP is a free and open source Enterprise Resource Planning tool. In versions below 14.89.2 and 15.0.0 through 15.75.1, lack of validation of parameters left ce… |
CVE-2025-58375 | High | 8.1 | 2025-09-06 | Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable… |
CVE-2025-55732 | High | 7.5 | 2025-08-20 | Frappe is a full-stack web application framework. Prior to 15.74.2 and 14.96.15, an attacker could implement SQL injection through specially crafted requests… |
CVE-2025-55731 | High | 8.8 | 2025-08-20 | Frappe is a full-stack web application framework. A carefully crafted request could extract data that the user would normally not have access to, via SQL injec… |
CVE-2025-55006 | Medium | 4.3 | 2025-08-09 | Frappe Learning is a learning system that helps users structure their content. In versions 2.33.0 and below, the image upload functionality did not adequately… |
CVE-2025-53545 | | 2025-07-08 | Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Users can circumvent 2F… | |
CVE-2025-52898 | High | 8.8 | 2025-06-30 | Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, a carefully crafted request could lead to a malicious actor getting ac… |
CVE-2025-52896 | Medium | 5.4 | 2025-06-30 | Frappe is a full-stack web application framework. Prior to versions 14.94.2 and 15.57.0, authenticated users could upload carefully crafted malicious files via… |
CVE-2025-52895 | High | 7.5 | 2025-06-30 | Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, SQL injection could be achieved via a specially crafted request, which… |
CVE-2025-28062 | High | 8.1 | 2025-05-05 | A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized a… |
CVE-2025-30217 | High | 7.5 | 2025-03-26 | Frappe is a full-stack web application framework. Prior to versions 14.93.2 and 15.55.0, a SQL Injection vulnerability has been identified in Frappe Framework… |
CVE-2025-30214 | High | 7.5 | 2025-03-25 | Frappe is a full-stack web application framework. Prior to versions 14.89.0 and 15.51.0, making crafted requests could lead to information disclosure that coul… |
CVE-2025-30213 | High | 8.8 | 2025-03-25 | Frappe is a full-stack web application framework. Prior to versions 14.91.0 and 15.52.0, a system user was able to create certain documents in a specific way t… |
CVE-2025-30212 | High | 7.5 | 2025-03-25 | Frappe is a full-stack web application framework. An SQL Injection vulnerability has been identified in Frappe Framework prior to versions 14.89.0 and 15.51.0… |
CVE-2024-50356 | Unrated | | 2024-10-31 | Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). The password could be r… |
CVE-2024-49751 | | 2024-10-23 | Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Prior to commit 5d118a9… | |
CVE-2024-34074 | Medium | 6.1 | 2024-05-14 | Frappe is a full-stack web application framework. Prior to 15.26.0 and 14.74.0, the login page accepts redirect argument and it allowed redirect to untrusted e… |
CVE-2024-27105 | High | 8.1 | 2024-03-21 | Frappe is a full-stack web application framework. Prior to versions 14.66.3 and 15.16.0, file permission can be bypassed using certain endpoints, granting less… |
CVE-2024-24813 | High | 7.5 | 2024-03-21 | Frappe is a full-stack web application framework. Prior to versions 14.64.0 and 15.0.0, SQL injection from a particular whitelisted method can result in access… |
CVE-2024-24812 | Medium | 5.4 | 2024-02-07 | Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to version… |
CVE-2023-46127 | Medium | 5.4 | 2023-10-23 | Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Frappe user… |
CVE-2023-5555 | Medium | 6.1 | 2023-10-12 | Cross-site Scripting (XSS) - Generic in GitHub repository frappe/lms prior to 5614a6203fb7d438be8e2b1e3030e4528d170ec4. |
CVE-2023-42807 | Medium | 6.3 | 2023-09-21 | Frappe LMS is an open source learning management system. In versions 1.0.0 and prior, on the People Page of LMS, there was an SQL Injection vulnerability. The… |
CVE-2023-41328 | Medium | 4.2 | 2023-09-06 | Frappe is a low code web framework written in Python and Javascript. A SQL Injection vulnerability has been identified in the Frappe Framework which could allo… |
CVE-2022-41712 | Medium | 6.5 | 2022-11-25 | Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not correctly valida… |
CVE-2022-3988 | Low | 3.5 | 2022-11-14 | A vulnerability was found in Frappe. It has been rated as problematic. Affected by this issue is some unknown functionality of the file frappe/templates/includ… |
CVE-2022-28598 | Medium | 6.1 | 2022-08-22 | Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in out… |
CVE-2022-23055 | | 2022-06-22 | In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send… | |
CVE-2022-23058 | | 2022-06-22 | ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ fi… | |
CVE-2022-23057 | Medium | 5.4 | 2022-06-22 | In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly. A low privileged att… |
CVE-2022-23056 | | 2022-06-22 | In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an… | |
CVE-2020-35175 | Medium | 5.3 | 2020-12-11 | Frappe Framework 12 and 13 does not properly validate the HTTP method for the frappe.client API. |
CVE-2020-27508 | High | 7.5 | 2020-12-11 | In two-factor authentication, the system also sending 2fa secret key in response, which enables an intruder to breach the 2fa security. |
CVE-2020-6145 | High | 8.8 | 2020-08-10 | An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can cause an SQL inj… |
CVE-2019-20521 | Medium | 6.1 | 2020-03-19 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI. |
CVE-2019-20520 | Medium | 6.1 | 2020-03-19 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI. |
CVE-2019-20519 | Medium | 6.1 | 2020-03-19 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address. |
CVE-2019-20518 | Medium | 6.1 | 2020-03-19 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI. |
CVE-2019-20517 | Medium | 6.1 | 2020-03-19 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI. |
CVE-2019-20516 | Medium | 6.1 | 2020-03-19 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI. |
CVE-2019-20515 | Medium | 6.1 | 2020-03-19 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI. |
CVE-2019-20514 | Medium | 6.1 | 2020-03-19 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI. |
CVE-2019-20529 | High | 7.5 | 2020-03-18 | In core/doctype/prepared_report/prepared_report.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as public files (no authent… |
CVE-2019-20511 | Medium | 6.1 | 2020-03-18 | ERPNext 11.1.47 allows blog?blog_category= Frame Injection. |
CVE-2019-15700 | Medium | 6.1 | 2019-08-27 | public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed va… |
CVE-2019-14967 | Medium | 6.1 | 2019-08-12 | An issue was discovered in Frappe Framework 10, 11 before 11.1.46, and 12. There exists an XSS vulnerability. |
CVE-2019-14966 | High | 8.8 | 2019-08-12 | An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. There exists an authenticated SQL injection. |
CVE-2019-14965 | Critical | 9.8 | 2019-08-12 | An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. A server side template injection (SSTI) issue exists. |
CVE-2018-20061 | High | 7.5 | 2018-12-11 | A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext… |
CVE-2018-3885 | High | 8.8 | 2018-09-12 | An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulti… |
CVE-2018-3884 | High | 8.8 | 2018-09-12 | An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulti… |
CVE-2018-3883 | High | 8.8 | 2018-09-12 | An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulti… |
CVE-2018-3882 | High | 8.8 | 2018-09-12 | An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulti… |
CVE-2018-11339 | Medium | 6.1 | 2018-05-22 | An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment. |
CVE-2017-1000120 | High | 8.8 | 2017-10-05 | [ERPNext][Frappe Version <= 7.1.27] SQL injection vulnerability in frappe.share.get_users allows remote authenticated users to execute arbitrary SQL commands v… |