Frappe vulnerabilities
266 CVEs and advisories name Frappe as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-109610Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification
- CVE-2026-109609Frappe ERPNext before 15.119.1 SQL Injection via Missing Input Validation
- CVE-2026-109608Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input
- CVE-2026-109604ERPNext before 15.112.0 Stored XSS via Tool View Record Names
- CVE-2026-109603Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkit
- CVE-2026-109602Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters
- CVE-2026-109601Frappe Framework before v16.30.0 Arbitrary File Read via Outgoing Email HTML
- CVE-2026-109600Frappe before 16.31.0 Improper Access Control in Document Follow Notifications
- CVE-2026-109599Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification
- CVE-2026-109598Frappe before 16.33.0 Broken Authorization via send_sms Endpoint
- CVE-2025-71432Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover
- CVE-2025-71431Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoint Parameters
- CVE-2025-71430Frappe before 15.91.1 Stored XSS via Leaderboard User Names
- CVE-2024-58391Frappe before 15.4.0 XSS via Printview Parameters
- CVE-2024-58390Frappe before 15.41.0 Privilege Escalation via Document Action
- CVE-2023-54412Frappe before 13.46.3 Improper Access Control for Email Templates
- CVE-2023-54411Frappe before 13.32.0 Weak Authentication via Print View Key
- CVE-2023-54410Frappe before 13.22.0 Improper Authorization via Document Rename
- CVE-2023-54409Frappe before 13.46.1 XSS via html2text Weak Sanitization
- CVE-2023-54408Frappe before 14.31.0 HTML Injection via Weak Escaping
- CVE-2023-54407Frappe 14.x before 14.45.0 Information Disclosure via Error Log Tracebacks
- CVE-2023-54406Frappe before 14.59.0 Safe Execution Flag Bypass in Server Scripts
- CVE-2026-109377ERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup Methods
- CVE-2026-109376ERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_html
- CVE-2026-108734Frappe CRM 1.49.0 through 1.87.0 Missing Authorization via get_linked_docs_of_document
- CVE-2026-108733Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation
- CVE-2026-108732Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount
- CVE-2026-101006Frappe HR Permission Validation __init__.py get_attendance_requests authorization
- CVE-2026-96672Frappe ERPNext before 16.34.1 Unauthorized Method Invocation
- CVE-2026-94113Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints