FR
Product
frappe
105
CVEs
0
On KEV
9.8
Max CVSS
21
New 30D
Severity mix
Critical 9High 31Medium 62Low 3
Watch
Add frappe to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-35175 | 5.3 | Dec 11 | Frappe Framework 12 and 13 does not properly validate the HTTP method for the frappe.client API Affected: 12.0.0 through 12.12.0; 13.0.0; 13.0.0; 13.0.0; 13.0.0; 13.0.0; +3 more |
| CVE-2026-66057 | 5.1 | Oct 13 | Frappe: Open Redirect via Unsanitized OAuth State Param. Affected: < 15.116.0; >= 16.0.0, < 16.29.0 |
| CVE-2026-49391 | 5.1 | Aug 6 | Frappe: Stored XSS in Column Headers via Data Import Affected: >= 16.0.0-beta.1, < 16.19.0; < 15.109.0 |
| CVE-2026-47185 | 5.1 | Aug 6 | Frappe Has Broken Access Control in its Workspace Save API Affected: < 16.18.0 |
| CVE-2026-31878 | 5.0 | Mar 11 | Frappe: Possible SSRF by any authenticated user Affected: >= 16.0.0, < 16.6.0; >= 15.0.0, < 15.100.0; < 14.100.1 |
| CVE-2023-54407 | 4.9 | Oct 12 | Frappe 14.x before 14.45.0 Information Disclosure via Error Log Tracebacks Affected: 14.0.0 before 14.45.0 |
| CVE-2023-54406 | 4.9 | Oct 12 | Frappe before 14.59.0 Safe Execution Flag Bypass in Server Scripts Affected: before 14.59.0; 15.0.0 before 15.5.0 |
| CVE-2023-54409 | 4.8 | Oct 12 | Frappe before 13.46.1 XSS via html2text Weak Sanitization Affected: before 13.46.1; 14.0.0-beta.1 before 14.20.0 |
| CVE-2026-109599 | 4.3 | Oct 12 | Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification Affected: before 15.113.3; 16.0.0-beta.1 before 16.25.0 |
| CVE-2026-109598 | 4.3 | Oct 12 | Frappe before 16.33.0 Broken Authorization via send_sms Endpoint Affected: before 15.120.0; 16.0.0-beta.1 before 16.33.0 |
| CVE-2024-58391 | 4.3 | Oct 12 | Frappe before 15.4.0 XSS via Printview Parameters Affected: before 14.58.0; 15.0.0 before 15.4.0 |
| CVE-2023-54410 | 4.3 | Oct 12 | Frappe before 13.22.0 Improper Authorization via Document Rename Affected: before 13.22.0 |