Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9

Export CSV
CVE-2026-31017

SSRF Vulnerability in ERPNext PDF Rendering Enables Internal Resource Discovery and Data Exposure

A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-supplied HTML is insufficiently sanitized before being rendered into PDF. When generating PDFs from user-controlled HTML content, the application allows the inclusion of HTML elements such as <iframe> that reference external resources. The PDF rendering engine automatically fetches these resources on the server side. An attacker can abuse this behavior to force the server to make arbitrary HTTP requests to internal services, including cloud metadata endpoints, potentially leading to sensitive information disclosure.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Erpnext Framework Frappe
CVE-2026-50704

Frappe Framework 17.0.0-dev - Reflected/Stored XSS in File View breadcrumbs rendering

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the File View breadcrumb renderer.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Framework Frappe Framework
CVE-2026-50712

Frappe Framework 17.0.0-dev - Stored XSS in Tree View node label rendering

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the frappe.ui.Tree component

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Framework Frappe Framework
CVE-2026-50703

Frappe Framework 17.0.0-dev - Stored XSS in Desktop Icon label rendering

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Desk desktop icon renderer.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Framework Frappe Framework
CVE-2026-50710

Frappe Framework 17.0.0-dev - Stored XSS via eval in Number Card filters_config

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to unsafe evaluation of user-controlled data in the Number Card component.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Framework Frappe Framework
CVE-2026-50700

Frappe Framework 17.0.0-dev - Stored XSS in frappe.get_avatar image rendering

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the frappe.get_avatar function.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Framework Frappe Framework
CVE-2026-50708

Frappe Framework 17.0.0-dev - Stored XSS in Multi Select Dialog result rendering

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the MultiSelectDialog component.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Framework Frappe Framework
CVE-2026-50698

Frappe Framework 17.0.0-dev - Stored XSS in Audit Trail template rendering

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input before generating HTML output in the Audit Trail component.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Framework Frappe Framework
CVE-2026-50699

Frappe Framework 17.0.0-dev - Stored XSS in Auto Repeat dashboard schedule rendering

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev. An authenticated attacker with write access to Auto Repeat can persist HTML/JavaScript in reference_document using a whitelisted write path and trigger script execution when users open the affected Auto Repeat form.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Framework Frappe Framework