FR
Product
frappe
105
CVEs
0
On KEV
9.8
Max CVSS
21
New 30D
Severity mix
Critical 9High 31Medium 62Low 3
Watch
Add frappe to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-58390 | 8.8 | Oct 12 | Frappe before 15.41.0 Privilege Escalation via Document Action Affected: before 14.81.4; 15.0.0 before 15.41.0 |
| CVE-2026-29081 | 8.8 | Mar 5 | Frappe is a full-stack web application framework Affected: before 14.100.1; 15.0.0 through 15.100.0 |
| CVE-2025-55731 | 8.8 | Aug 20 | Frappe is a full-stack web application framework Affected: before 14.96.15; 15.0.0 before 15.74.2 |
| CVE-2025-52898 | 8.8 | Jun 30 | Frappe is a full-stack web application framework Affected: before 14.94.3; 15.0.0 before 15.58.0 |
| CVE-2025-30213 | 8.8 | Mar 25 | Frappe is a full-stack web application framework Affected: before 14.91.0; 15.0.0 before 15.52.0 |
| CVE-2019-14966 | 8.8 | Aug 12 | An issue was discovered in Frappe Framework 10 through 12 before 12.0.4 Affected: 10.0.0 through 12.0.4 |
| CVE-2017-1000120 | 8.8 | Oct 5 | [ERPNext][Frappe Version <= 7.1.27] SQL injection vulnerability in frappe.share.get_users allows remote authenticated users to execute arbitrary SQL commands via the fields… Affected: through 7.1.27 |
| CVE-2026-55823 | 8.7 | Oct 13 | Frappe: Possibility of SQL injection in reportview Affected: < 16.23.0 |
| CVE-2026-39352 | 8.7 | May 20 | Frappe has an Arbitrary File Read via Path Traversal in render_include Affected: < 15.105.0; >= 15.106.0, < 16.15.0 |
| CVE-2026-47194 | 8.6 | Aug 6 | Frappe: Host header poisoning can redirect magic login links to an attacker-controlled domain Affected: >= 16.0.0-beta.1, < 16.18.3; < 15.108.0 |
| CVE-2026-55852 | 8.6 | Jul 10 | Frappe: TarSlip RCE in Package Import Affected: < 15.112.0; >= 16.0.0-beta.1, < 16.23.0 |
| CVE-2025-66206 | 8.6 | Dec 1 | Frappe is a full-stack web application framework Affected: before 14.99.2; 15.0.0 before 15.86.0 |
| CVE-2026-66001 | 8.5 | Aug 20 | Frappe: Improper Authorization in OAuth2 Consent Endpoint Affected: < 15.114.0; >= 16.0.0-beta.1, < 16.26.0 |
| CVE-2025-68953 | 7.5 | Jan 5 | Frappe is a full-stack web application framework Affected: before 14.99.6; 15.0.0 before 15.88.1 |
| CVE-2025-55732 | 7.5 | Aug 20 | Frappe is a full-stack web application framework Affected: before 14.96.15; 15.0.0 before 15.74.2 |
| CVE-2025-52895 | 7.5 | Jun 30 | Frappe is a full-stack web application framework Affected: before 14.94.3; 15.0.0 before 15.58.0 |
| CVE-2025-30217 | 7.5 | Mar 26 | Frappe is a full-stack web application framework Affected: before 14.93.2; 15.0.0 before 15.55.0 |
| CVE-2025-30214 | 7.5 | Mar 25 | Frappe is a full-stack web application framework Affected: before 14.89.0; 15.0.0 before 15.51.0 |
| CVE-2025-30212 | 7.5 | Mar 25 | Frappe is a full-stack web application framework Affected: before 14.89.0; 15.0.0 before 15.51.0 |
| CVE-2024-24813 | 7.5 | Mar 21 | Frappe is a full-stack web application framework Affected: before 14.64.0 |
| CVE-2023-41328 | 7.5 | Sep 6 | Frappe is a low code web framework written in Python and Javascript Affected: before 13.46.1; 14.0.0 before 14.20.0 |
| CVE-2020-27508 | 7.5 | Dec 11 | In two-factor authentication, the system also sending 2fa secret key in response, which enables an intruder to breach the 2fa security Affected: before 12.10.0 |
| CVE-2019-20529 | 7.5 | Mar 18 | In core/doctype/prepared_report/prepared_report.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as public files (no authentication is required… Affected: 11.0.0; 12.0.0 |
| CVE-2026-28436 | 7.2 | Mar 5 | Frappe is a full-stack web application framework Affected: before 15.102.0; 16.0.0 before 16.11.0 |
| CVE-2026-114664 New | 7.1 | Oct 22 | Frappe before 16.33.0 Blind SQL Injection via get_events Affected: before 16.33.0 |
| CVE-2026-66003 | 7.1 | Aug 26 | Frappe: Access control bypass via REST API dot-notation fields on linked doctypes Affected: < 15.115.0 |
| CVE-2026-62315 | 7.1 | Aug 20 | Frappe: Mass assignment via set_value Affected: <= 16.31.0 |
| CVE-2026-47765 | 7.1 | Aug 6 | Frappe: Lack of Permissions in restore/bulk_restore Affected: < 15.110.0; >= 16.0.0-beta.1, < 16.20.0 |
| CVE-2026-49394 | 7.1 | Jul 10 | Frappe: Auth. bypass via update_page Affected: < 16.19.0 |
| CVE-2026-41482 | 7.1 | Jul 10 | Frappe: Possible Path Traversal and Local File Inclusion via Chrome PDF Generator Affected: < 16.18.3 |
| CVE-2026-29077 | 7.1 | Mar 5 | Frappe is a full-stack web application framework Affected: before 14.100.0; 15.0.0 before 15.98.0 |
Showing 31