Skip to content
Threat Feed
Subscribe

Vendor

Frappe

7 briefs RSS
critical advisory

Frappe Framework: Path traversal vulnerability (CVE-2026-119145)

Frappe contains a path traversal vulnerability in its file-upload handling that can allow authenticated attackers to achieve remote code execution.

Frappe Framework +1
2c
high advisory

Frappe Builder: Server-side request forgery (CVE-2026-115717)

Frappe Builder versions before 1.36.1 contain an SSRF vulnerability in the convert_to_webp endpoint, allowing authenticated users to probe internal infrastructure or exfiltrate sensitive data.

Frappe Builder
1t 1c
high advisory

Frappe Framework: Blind SQL injection (CVE-2026-114664)

Frappe Framework versions prior to 16.33.0 contain a blind SQL injection vulnerability in the get_events method, allowing authenticated attackers to extract sensitive database content.

Frappe Framework
1t 1c
high advisory

SQL Injection Vulnerability in Frappe HRMS

Authenticated attackers can exploit a SQL injection vulnerability in specific Frappe HRMS API endpoints to extract sensitive database information due to missing input validation.

PoC HRMS +1 web-application-security sql-injection cve-2026-111389
1t 1c
high advisory

Reflected Cross-Site Scripting Vulnerability in Frappe ERPNext

Frappe ERPNext versions before 14.92.1 and 15.x before 15.83.0 are susceptible to reflected XSS, allowing unauthenticated attackers to execute arbitrary JavaScript in authenticated sessions.

ERPNext +3 vulnerability authorization-bypass server-side-template-injection web-application-vulnerability
4t 1c
high advisory

Improper Privilege Management in Frappe Framework

Frappe versions 14.x and 15.x contain a privilege management vulnerability allowing authenticated Website Users to escalate to System Manager privileges via document action manipulation.

Frappe Framework privilege-escalation frappe cve-2024-58390
1t 1c
critical advisory

Frappe Framework ERPNext 13.4.0 Sandbox Escape Vulnerability

Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability allowing authenticated users with System Manager role to execute arbitrary code via frame introspection and `os.popen`.

ERPNext +1 sandbox-escape rce
2r 1t 1c