Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 328

Export CSV
CVE-2026-41320

Frappe HR has possibility of SQL Injection due to improper field sanitization

Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.54.0 and 14.38.1, a specially crafted request made to a certain endpoint could result in SQL injection, allowing an attacker to extract information they wouldn't otherwise be able to. Versions 15.54.0 and 14.38.1 contain a patch. No known workarounds are available.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Frappe Hr Hrms
CVE-2026-23497

Frappe LMS has a Stored XSS via Unsanitized Image Filename in Course and Jobs Pages

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In 2.44.0 and earlier, there is a stored XSS vulnerability where a specially crafted image filename could execute malicious JavaScript when rendered on course or jobs pages.

CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Frappe Frappe Lms Learning
CVE-2026-25956

Frappe Affected by XSS and Open Redirect in Sign Up

Frappe is a full-stack web application framework. Prior to 14.99.14 and 15.94.0, an attacker could craft a malicious signup URL for a frappe site which could lead to an open redirect (or reflected XSS, depending on the crafted payload) when a user signs up. This vulnerability is fixed in 14.99.14 and 15.94.0.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Frappe
CVE-2026-27471

ERP: Document access through endpoints due to missing validation

ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 16.6.0, certain endpoints lacked access validation which allowed for unauthorized document access. This issue has been fixed in versions 15.98.1 and 16.6.1.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Erpnext
CVE-2026-26031

Frappe LMS affected by unauthorised user was able to access the full list of batch enrolled students

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.44.0, security issue was identified in Frappe Learning, where unauthorised users were able to access the full list of enrolled students (by email) in batches. This vulnerability is fixed in 2.44.0.

CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Frappe Lms Learning
CVE-2026-26977

Frappe Learning Management System exposes details of unpublished courses to unauthorized users

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.44.0 and below, unauthorized users are able to access the details of unpublished courses via API endpoints. A fix for this issue is planned for the 2.45.0 release.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Learning Lms
CVE-2026-29077

Frappe: Broken Access Control in DocShare

Frappe is a full-stack web application framework. Prior to versions 15.98.0 and 14.100.0, due to a lack of validation when sharing documents, a user could share a document with a permission that they themselves didn't have. This issue has been patched in versions 15.98.0 and 14.100.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Frappe
CVE-2026-28436

Frappe: Stored XSS in avatar_macro.html

Frappe is a full-stack web application framework. Prior to versions 16.11.0 and 15.102.0, an attacker can set a crafted image URL that results in XSS when the avatar is displayed, and it can be triggered for other users via website page comments. This issue has been patched in versions 16.11.0 and 15.102.0.

CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Frappe
CVE-2026-29081

Frappe: Possibility of SQL Injection due to improper fieldname sanitization

Frappe is a full-stack web application framework. Prior to versions 14.100.1 and 15.100.0, an endpoint was vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This issue has been patched in versions 14.100.1 and 15.100.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Frappe
CVE-2025-59421

Press vulnerable to email flooding to users due to lack of validation and rate limits

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). A bad actor can flood the inbox of a user by repeatedly sending invites (duplicate). The issue is fixed in commit 83c3fc7676c5dbbe1fd5092d21d95a10c7b48615.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Frappe Press
CVE-2026-35614

Frappe has a SQL injection in bulk_update

Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe has a SQL injection in bulk_update. This vulnerability is fixed in 16.14.0 and 15.104.0.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Frappe
CVE-2025-10655

Frappe Helpdesk 1.14.0 — SQL Injection in dashboard get_dashboard_data

SQL Injection in Frappe HelpDesk in the dashboard get_dashboard_data due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.This issue affects Frappe HelpDesk: 1.14.0.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Frappe Helpdesk Helpdesk
CVE-2026-39351

Frappe allows unrestricted Doctype access via API exploit

Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe allows unrestricted Doctype access via API exploit.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Frappe
CVE-2026-39415

Frappe Learning Management System has Client-Side Manipulation of Quiz Scores

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.46.0, a vulnerability has been identified in Frappe Learning where quiz scores can be modified by students before submission. The application currently relies on client-side calculated scores, which can be altered using browser developer tools prior to sending the submission request. While this does not allow modification of other users’ data or privilege escalation, it compromises the integrity of quiz results and undermines academic reliability. This issue affects data integrity but does not expose confidential information or allow unauthorized access to other accounts. This vulnerability is fixed in 2.46.0.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Learning Lms
CVE-2026-34606

Stored XSS in Frappe LMS

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. From version 2.27.0 to before version 2.48.0, Frappe LMS was vulnerable to stored XSS. This issue has been patched in version 2.48.0.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Learning Lms
CVE-2026-32954

ERP has a possibility SQL Injection vulnerability due to missing validation

ERP is a free and open source Enterprise Resource Planning tool. In versions prior to 16.8.0 and 15.100.0, certain endpoints were vulnerable to time-based and boolean-based blind SQL injection due to insufficient parameter validation, allowing attackers to infer database information. This issue has been fixed in versions 15.100.0 and 16.8.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Erpnext
CVE-2025-11282

Frappe LMS Incomplete Fix CVE-2025-55006 cross site scripting

A vulnerability was found in Frappe LMS 2.34.x/2.35.0. The impacted element is an unknown function of the component Incomplete Fix CVE-2025-55006. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The affected component should be upgraded. The vendor was informed early about a total of four security issues and confirmed that those have been fixed. However, the release notes on GitHub do not mention them.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Frappe Lms Learning
CVE-2026-31877

Frappe SQL Injection due to improper field sanitization

Frappe is a full-stack web application framework. Prior to 15.84.0 and 14.99.0, a specially crafted request made to a certain endpoint could result in SQL injection, allowing an attacker to extract information they wouldn't otherwise be able to. This vulnerability is fixed in 15.84.0 and 14.99.0.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Frappe
CVE-2026-31878

Frappe: Possible SSRF by any authenticated user

Frappe is a full-stack web application framework. Prior to 14.100.1, 15.100.0, and 16.6.0, a malicious user could send a crafted request to an endpoint which would lead to the server making an HTTP call to a service of the user's choice. This vulnerability is fixed in 14.100.1, 15.100.0, and 16.6.0.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Frappe
CVE-2026-31879

Frappe Workspace modification and stored XSS due to improper resource ownership checks

Frappe is a full-stack web application framework. Prior to 14.100.2, 15.101.0, and 16.10.0, due to a lack of validation and improper permission checks, users could modify other user's private workspaces. Specially crafted requests could lead to stored XSS here. This vulnerability is fixed in 14.100.2, 15.101.0, and 16.10.0.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Frappe