Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12

Export CSV
CVE-2026-50704

Frappe Framework 17.0.0-dev - Reflected/Stored XSS in File View breadcrumbs rendering

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the File View breadcrumb renderer.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Framework Frappe Framework
CVE-2026-50712

Frappe Framework 17.0.0-dev - Stored XSS in Tree View node label rendering

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the frappe.ui.Tree component

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Framework Frappe Framework
CVE-2026-50703

Frappe Framework 17.0.0-dev - Stored XSS in Desktop Icon label rendering

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Desk desktop icon renderer.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Framework Frappe Framework
CVE-2026-50710

Frappe Framework 17.0.0-dev - Stored XSS via eval in Number Card filters_config

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to unsafe evaluation of user-controlled data in the Number Card component.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Framework Frappe Framework
CVE-2026-50700

Frappe Framework 17.0.0-dev - Stored XSS in frappe.get_avatar image rendering

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the frappe.get_avatar function.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Framework Frappe Framework
CVE-2026-50708

Frappe Framework 17.0.0-dev - Stored XSS in Multi Select Dialog result rendering

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the MultiSelectDialog component.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Framework Frappe Framework
CVE-2026-50698

Frappe Framework 17.0.0-dev - Stored XSS in Audit Trail template rendering

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input before generating HTML output in the Audit Trail component.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Framework Frappe Framework
CVE-2026-50699

Frappe Framework 17.0.0-dev - Stored XSS in Auto Repeat dashboard schedule rendering

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev. An authenticated attacker with write access to Auto Repeat can persist HTML/JavaScript in reference_document using a whitelisted write path and trigger script execution when users open the affected Auto Repeat form.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Framework Frappe Framework
CVE-2026-50701

Frappe Framework 17.0.0-dev - Reflected DOM XSS in dashboard-view breadcrumb rendering

A Reflected Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the dashboard-view component.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Frappe Framework
CVE-2026-50705

Frappe Framework 17.0.0-dev - Stored XSS in Form Dashboard headline rendering

A Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of untrusted input in the Form Dashboard headline renderer.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Frappe Framework
CVE-2026-50709

Frappe Framework 17.0.0-dev - Stored XSS in Notifications Events color rendering

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Notifications > Events panel.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Frappe Framework
CVE-2026-50711

Frappe Framework 17.0.0-dev - Stored XSS in Number Card filter fields rendering

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Number Card component.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Frappe Framework