Frappe Framework (< 16.33.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/frappe-framework--16.33.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 03:53:16 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFrappe Framework: Blind SQL injection (CVE-2026-114664)https://feed.craftedsignal.io/briefs/2026-10-frappe-sqli/Thu, 22 Oct 2026 03:53:16 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-frappe-sqli/Frappe Framework versions prior to 16.33.0 contain a blind SQL injection vulnerability in the get_events method, allowing authenticated attackers to extract sensitive database content.Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method. The vulnerability arises from the failure to properly neutralize user-supplied input before it is included in SQL queries. An authenticated attacker can send crafted input to the affected method and infer query results based on the application's response, leading to the unauthorized exfiltration of database contents.

Impact

Successful exploitation allows an authenticated attacker to perform blind SQL injection, which can lead to the unauthorized extraction of sensitive data from the underlying database.

Recommendation

  • Upgrade the Frappe Framework to version 16.33.0 or later to remediate this vulnerability.
  • Review web server access logs for anomalous requests targeting the 'frappe.desk.doctype.event.event.get_events' endpoint.
  • Implement strict input validation and parameterized queries for all database interaction methods if upgrading is not immediately possible.
]]>highadvisory