FR
Product
frappe
105
CVEs
0
On KEV
9.8
Max CVSS
21
New 30D
Severity mix
Critical 9High 31Medium 62Low 3
Watch
Add frappe to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-35614 | 9.8 | Apr 7 | Frappe is a full-stack web application framework Affected: before 15.104.0; 16.0.0 before 16.14.0 |
| CVE-2026-31877 | 9.8 | Mar 11 | Frappe is a full-stack web application framework Affected: before 14.99.0; 15.0.0 before 15.84.0 |
| CVE-2025-66205 | 9.8 | Dec 1 | Frappe is a full-stack web application framework Affected: before 14.99.2; 15.0.0 before 15.86.0 |
| CVE-2019-14965 | 9.8 | Aug 12 | An issue was discovered in Frappe Framework 10 through 12 before 12.0.4 Affected: 10.0.0 before 12.0.4 |
| CVE-2025-67289 | 9.6 | Dec 22 | An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file Affected: 15.89.0 |
| CVE-2026-31017 | 9.1 | Apr 8 | A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-supplied HTML is… Affected: 16.1.1 |
| CVE-2026-39351 | 9.1 | Apr 7 | Frappe is a full-stack web application framework Affected: before 15.104.0; 16.0.0 before 16.14.0 |
| CVE-2025-68929 | 9.0 | Dec 29 | Frappe is a full-stack web application framework Affected: before 14.99.6; 15.0.0 before 15.88.1 |
| CVE-2025-65267 | 9.0 | Dec 3 | In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript Affected: 15.86.0 |
| CVE-2024-58390 | 8.8 | Oct 12 | Frappe before 15.41.0 Privilege Escalation via Document Action Affected: before 14.81.4; 15.0.0 before 15.41.0 |
| CVE-2026-29081 | 8.8 | Mar 5 | Frappe is a full-stack web application framework Affected: before 14.100.1; 15.0.0 through 15.100.0 |
| CVE-2025-55731 | 8.8 | Aug 20 | Frappe is a full-stack web application framework Affected: before 14.96.15; 15.0.0 before 15.74.2 |
| CVE-2025-52898 | 8.8 | Jun 30 | Frappe is a full-stack web application framework Affected: before 14.94.3; 15.0.0 before 15.58.0 |
| CVE-2025-30213 | 8.8 | Mar 25 | Frappe is a full-stack web application framework Affected: before 14.91.0; 15.0.0 before 15.52.0 |
| CVE-2019-14966 | 8.8 | Aug 12 | An issue was discovered in Frappe Framework 10 through 12 before 12.0.4 Affected: 10.0.0 through 12.0.4 |
| CVE-2017-1000120 | 8.8 | Oct 5 | [ERPNext][Frappe Version <= 7.1.27] SQL injection vulnerability in frappe.share.get_users allows remote authenticated users to execute arbitrary SQL commands via the fields… Affected: through 7.1.27 |
| CVE-2026-55823 | 8.7 | Oct 13 | Frappe: Possibility of SQL injection in reportview Affected: < 16.23.0 |
| CVE-2026-39352 | 8.7 | May 20 | Frappe has an Arbitrary File Read via Path Traversal in render_include Affected: < 15.105.0; >= 15.106.0, < 16.15.0 |
| CVE-2026-47194 | 8.6 | Aug 6 | Frappe: Host header poisoning can redirect magic login links to an attacker-controlled domain Affected: >= 16.0.0-beta.1, < 16.18.3; < 15.108.0 |
| CVE-2026-55852 | 8.6 | Jul 10 | Frappe: TarSlip RCE in Package Import Affected: < 15.112.0; >= 16.0.0-beta.1, < 16.23.0 |
| CVE-2025-66206 | 8.6 | Dec 1 | Frappe is a full-stack web application framework Affected: before 14.99.2; 15.0.0 before 15.86.0 |
| CVE-2026-66001 | 8.5 | Aug 20 | Frappe: Improper Authorization in OAuth2 Consent Endpoint Affected: < 15.114.0; >= 16.0.0-beta.1, < 16.26.0 |
| CVE-2025-68953 | 7.5 | Jan 5 | Frappe is a full-stack web application framework Affected: before 14.99.6; 15.0.0 before 15.88.1 |
| CVE-2025-55732 | 7.5 | Aug 20 | Frappe is a full-stack web application framework Affected: before 14.96.15; 15.0.0 before 15.74.2 |
| CVE-2025-52895 | 7.5 | Jun 30 | Frappe is a full-stack web application framework Affected: before 14.94.3; 15.0.0 before 15.58.0 |
| CVE-2025-30217 | 7.5 | Mar 26 | Frappe is a full-stack web application framework Affected: before 14.93.2; 15.0.0 before 15.55.0 |
| CVE-2025-30214 | 7.5 | Mar 25 | Frappe is a full-stack web application framework Affected: before 14.89.0; 15.0.0 before 15.51.0 |
| CVE-2025-30212 | 7.5 | Mar 25 | Frappe is a full-stack web application framework Affected: before 14.89.0; 15.0.0 before 15.51.0 |
| CVE-2024-24813 | 7.5 | Mar 21 | Frappe is a full-stack web application framework Affected: before 14.64.0 |
| CVE-2023-41328 | 7.5 | Sep 6 | Frappe is a low code web framework written in Python and Javascript Affected: before 13.46.1; 14.0.0 before 14.20.0 |
| CVE-2020-27508 | 7.5 | Dec 11 | In two-factor authentication, the system also sending 2fa secret key in response, which enables an intruder to breach the 2fa security Affected: before 12.10.0 |
| CVE-2019-20529 | 7.5 | Mar 18 | In core/doctype/prepared_report/prepared_report.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as public files (no authentication is required… Affected: 11.0.0; 12.0.0 |
| CVE-2026-28436 | 7.2 | Mar 5 | Frappe is a full-stack web application framework Affected: before 15.102.0; 16.0.0 before 16.11.0 |
| CVE-2026-114664 New | 7.1 | Oct 22 | Frappe before 16.33.0 Blind SQL Injection via get_events Affected: before 16.33.0 |
| CVE-2026-66003 | 7.1 | Aug 26 | Frappe: Access control bypass via REST API dot-notation fields on linked doctypes Affected: < 15.115.0 |
| CVE-2026-62315 | 7.1 | Aug 20 | Frappe: Mass assignment via set_value Affected: <= 16.31.0 |
| CVE-2026-47765 | 7.1 | Aug 6 | Frappe: Lack of Permissions in restore/bulk_restore Affected: < 15.110.0; >= 16.0.0-beta.1, < 16.20.0 |
| CVE-2026-49394 | 7.1 | Jul 10 | Frappe: Auth. bypass via update_page Affected: < 16.19.0 |
| CVE-2026-41482 | 7.1 | Jul 10 | Frappe: Possible Path Traversal and Local File Inclusion via Chrome PDF Generator Affected: < 16.18.3 |
| CVE-2026-29077 | 7.1 | Mar 5 | Frappe is a full-stack web application framework Affected: before 14.100.0; 15.0.0 before 15.98.0 |
| CVE-2026-66002 | 6.9 | Aug 20 | Frappe: User Enumeration via PDDR Affected: < 15.115.0; >= 16.0.0-beta.1, < 16.27.0 |
| CVE-2026-63654 | 6.9 | Aug 20 | Frappe: Unauthenticated Workflow approval via confirm_action Affected: <= 16.31.0 |
| CVE-2026-42219 | 6.9 | Jul 10 | Frappe: Path Traversal via /backups Route Affected: < 15.109.0; >= 16.0.0-beta.1, < 16.19.0 |
| CVE-2026-58503 | 6.9 | Jul 10 | Frappe: Unauthenticated User Enumeration via reset_password Affected: < 15.106.0; >= 16.0.0-beta1, < 16.16.0 |
| CVE-2026-53568 | 6.9 | Jun 12 | Frappe: Stored XSS in Frappe Report/List View via 'set_link_title_field_value' Affected: < 15.107.2; < 16.17.4 |
| CVE-2026-50026 | 6.9 | Jun 12 | Frappe: Lack of permissions checks in 'relink' and 'set_email_password' endpoints Affected: < 15.107.0; < 16.17.0 |
| CVE-2026-44206 | 6.9 | Jun 12 | Frappe: DB Schema Enumeration via Frappe-Authorization-Source Affected: < 15.107.2; < 16.17.4 |
| CVE-2026-44207 | 6.9 | Jun 12 | Frappe: Insecure Direct Object Reference for email accounts Affected: < 15.107.0; < 16.17.0 |
| CVE-2026-44208 | 6.9 | Jun 12 | Frappe: IDOR in `submit_discussion()` Affected: < 15.107.0; < 16.17.0 |
| CVE-2026-44205 | 6.9 | Jun 12 | Frappe: Stored Cross-Site Scripting (XSS) in User Profile through Image Upload Affected: < 15.106.0 |