Frappe vulnerabilities
266 CVEs and advisories name Frappe as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-54343Frappe LMS: Path Traversal in SCORM File Serving
- CVE-2026-54524Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report
- CVE-2023-51769Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages.
- CVE-2026-53761Frappe CRM: Authentication Bypass via Logged Invitation Keys in crm/api
- CVE-2026-82634Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint
- CVE-2026-81731Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description
- CVE-2026-66003Frappe: Access control bypass via REST API dot-notation fields on linked doctypes
- CVE-2026-66002Frappe: User Enumeration via PDDR
- CVE-2026-66001Frappe: Improper Authorization in OAuth2 Consent Endpoint
- CVE-2026-62315Frappe: Mass assignment via set_value
- CVE-2026-63654Frappe: Unauthenticated Workflow approval via confirm_action
- CVE-2026-53569Frappe: Missing authorization in toggle_like and mark_as_seen
- CVE-2026-65822ERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filter
- CVE-2026-65974ERPNext: Server-Side Template Injection leading to Remote Code Execution
- CVE-2026-72911ERPNext: Possibility of server-side template injection due to missing validation
- CVE-2026-72910ERPNext: Unauthorised modification of master data due to missing validation
- CVE-2026-72909ERPNext: Broken Access Control on certain endpoints
- CVE-2026-72908ERPNext: Possibility of SQL injection due to missing validation
- CVE-2026-72907ERPNext: Broken Access Control on certain endpoint
- CVE-2026-72906ERPNext: Unauthorised triggering of automated emails due to missing validation
- CVE-2026-66000Frappe: Unrestricted access to Document Follow APIs
- CVE-2025-58375Frappe has potential SQL Injection due to missing validation
- CVE-2026-66058Frappe: Unrestricted access to a Document Follow API
- CVE-2026-66059Frappe: Field-level permission bypass via Document Follow
- CVE-2026-49391Frappe: Stored XSS in Column Headers via Data Import
- CVE-2026-47765Frappe: Lack of Permissions in restore/bulk_restore
- CVE-2026-47194Frappe: Host header poisoning can redirect magic login links to an attacker-controlled domain
- CVE-2026-47185Frappe Has Broken Access Control in its Workspace Save API
- CVE-2026-13227ERPNext v16.25.0 - Improper authorization in Prospect opportunities API
- CVE-2026-12895SQL Injection in Frappe's ERPNext