Frappe: User Enumeration via PDDR

Frappe: Unauthenticated Workflow approval via confirm_action

Frappe: Path Traversal via /backups Route

Frappe: Unauthenticated User Enumeration via reset_password

Frappe: Stored XSS in Frappe Report/List View via 'set_link_title_field_value'

Frappe: Lack of permissions checks in 'relink' and 'set_email_password' endpoints

Frappe: DB Schema Enumeration via Frappe-Authorization-Source

Frappe: Insecure Direct Object Reference for email accounts

Frappe: IDOR in `submit_discussion()`

Frappe: Stored Cross-Site Scripting (XSS) in User Profile through Image Upload

Frappe Vulnerable to Possible SQL Injection via get_blog_list

Frappe: Stored XSS in Note

Frappe Framework before v16.30.0 Arbitrary File Read via Outgoing Email HTML

Frappe before 13.46.3 Improper Access Control for Email Templates

Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint

ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the order_by and group_by parameters

Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value API endpoint and a crafted script to…

In Frappe 15.x.x before 15.72.0 and 14.x.x before 14.96.10, in the function add_tag() at `frappe/desk/doctype/tag/tag.py` is vulnerable to SQL Injection, which allows an attacker…

Frappe is a full-stack web application framework

Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files

Frappe before 14.31.0 HTML Injection via Weak Escaping

Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages

Frappe is a full-stack web application framework

Frappe is a full-stack web application framework

Frappe is a full-stack web application framework

A vulnerability was found in Frappe

public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed value of" text

An issue was discovered in Frappe Framework 10, 11 before 11.1.46, and 12

Frappe before 13.32.0 Weak Authentication via Print View Key

Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication

Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters

Frappe before 15.91.1 Stored XSS via Leaderboard User Names

Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description

Frappe Framework 16.10.0 - Stored DOM XSS in Multiple Field Formatters

Frappe Framework 16.10.0 - Stored DOM XSS in Tag Pill Renderer

Frappe is a full-stack web application framework

A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload…

Frappe is a full-stack web application framework

Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library

Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library

Frappe before 16.31.0 Improper Access Control in Document Follow Notifications

Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoint Parameters

Frappe: Missing authorization in toggle_like and mark_as_seen

Frappe: Unrestricted access to a Document Follow API

Frappe: Field-level permission bypass via Document Follow

Frappe: Arbitrary Attachment Injection via add_attachments and upload_file

Frappe: Unrestricted API access to save_report

Frappe: Broken Access Control on Private Files

Frappe: IDOR in update_onboarding_step

Frappe: Missing authorization on reset form tours