{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/frappe-framework--16.33.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:frappe:frappe_framework:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-114664"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Frappe Framework (\u003c 16.33.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Frappe"],"content_html":"\u003cp\u003eFrappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method. The vulnerability arises from the failure to properly neutralize user-supplied input before it is included in SQL queries. An authenticated attacker can send crafted input to the affected method and infer query results based on the application's response, leading to the unauthorized exfiltration of database contents.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated attacker to perform blind SQL injection, which can lead to the unauthorized extraction of sensitive data from the underlying database.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Frappe Framework to version 16.33.0 or later to remediate this vulnerability.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous requests targeting the 'frappe.desk.doctype.event.event.get_events' endpoint.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation and parameterized queries for all database interaction methods if upgrading is not immediately possible.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T03:53:16Z","date_published":"2026-10-22T03:53:16Z","id":"https://feed.craftedsignal.io/briefs/2026-10-frappe-sqli/","summary":"Frappe Framework versions prior to 16.33.0 contain a blind SQL injection vulnerability in the get_events method, allowing authenticated attackers to extract sensitive database content.","title":"Frappe Framework: Blind SQL injection (CVE-2026-114664)","url":"https://feed.craftedsignal.io/briefs/2026-10-frappe-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed - Frappe Framework (\u003c 16.33.0)","version":"https://jsonfeed.org/version/1.1"}